ML20003E846

Forwards Positions on post-TMI Requirements in NUREG-0737. Info Will Be Contained in Future Amend to FSAR

ML20003E846
Person / Time
Site:	Shoreham File:Long Island Lighting Company icon.png
Issue date:	04/15/1981
From:	Novarro J LONG ISLAND LIGHTING CO.
To:	Harold Denton Office of Nuclear Reactor Regulation
References
RTR-NUREG-0737, RTR-NUREG-737, TASK-***, TASK-TM SNRC-557, NUDOCS 8104170382
Download: ML20003E846 (109)

Text

...

LONG ISLAND LIGHTING COM PANY

7 14 t'O Jumpfs SHOREHAM NUCLEAR POWER STATION P.O. BOX 618, NORTH COUNTRY ROAD e WADING RIVER. N.Y.11792 April 15, 1981 SNRC-557 Mr. Harold R.

Denton, Director Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D.C.

20555 Shoreham Nuclear Power Station - Unit 1 Docket No. 50-322

Dear Mr. Denton:

Forwarded herein are fifteen (15) copies of our positions related to Post-TMI Requirements outlined in NUREG-0737.

These require-ments were transmitted via letter dated October 31, 1980 from Mr."Darrell G.

Eisenhut.

Where applicable, our responses to certain NUREG-0578 items (SNRC-503, dated August 29, 1980) are superceded by the respective responses contained herein.

The positions included in this submittal are listed in Attachment 1.

The present schedule for submittal of the remaining items is as shown in Attachment 2.

This information will be contained in a future amendment to the FSAR.

Please note that regarding our response to NUREG-0737, item II.K.3.27, Common Water Level Reference, we are in receipt of and presently assessing your letter from Mr.

D.

Eisenhut to Mr.

D.

B.

Waters, Chairman, BWR Owners Group, dated April 6, 1981.

Very truly yours, O

m i

vb im

/

{

jJ.

P.

Novarro

\\j' Shoreham Nuclear Power Station Project Manager

[4 D

Cb Q(o RWG:mp

/

\\

@}/ %

S s

cc: J.

Higgins C

c-s

$1omom Sch8 A

F C-4 93 5

ATTACHMENT 1 I.A.1.1 Shift Technical Advisor I.A.2.3 Administration of Training Programs I.C.2 Shift and Relief Turnover Procedures I.C.4 Control Room Access I.C.5 Procedures for Feedback of Operating Experience to Plant Staff II.D.3 Relief and Safety Valves Position Indication II.E.4.1 Containment Dedicated Penetrations II.K.l.5 Safety-Related Valve Position II.K.3.15 Modify Break Detection Logic to Prevent Spurious Isolation of EPCI and RCIC Systems II.K.3.17 Report on Outage of ECC Systems - Licensee Report and Proposed Technical Specification Changes II.K.3.21 Restart of Core Spray and.LPCI Systems on Low Level II.K.3.22 Automatic Switchover of Reactor Core Isolation Cooling System Suction - Verify Procedures and Modify Design II.K.3.27 Provide Common Reference Level for Vessel Level Instrumentation II.K.3.28 Study and Verify Qualificaticn of Accumulators on ADS Valves II.K.3.44 Evaluation of Anticipated Transients with Single Failure to Verify No Fuel Failure II.K.3.45 Evaluation of Depressurization with Other Than Full ADS II.K.3.46 Response to List of Concerns From ACRS Consultant

_ =,.

ATTACEMEh"r 2 i.

Items scheduled for submittal on 5/15/81 i

I.A.l.2 II.B.2 II.K.3.16 1.A.l.3 II.B.3 II.K.3.18 I.A.2.1 II.B.7 II.K.3.24 I.A.3.1 II.F.1 II.K.3.25 I.C.1 II.K.1.22 III.A.l.1 I.C.7 II.K.l.23 III.A.2 I.C.8 II.K.3.3 III.D.3.3 i

I.D.1 II.K.3.13 III.D.3.4 II.F.2 j

Items scheduled for submittal on 5/30/81 I.B.l.2 II.B.1 II.K.l.10 I.C.3 II.B.4 II.K.3.30 i

I.C.6 II.D.1 II.K.3o31 l

I.D.2 II.E.4.2 III.A.l.2 I.G.1 II.F.3 III.D.l.1 i

a I

SNPS-1 FSAR I_NTRODUCTION This section contains the Shoreham positions for the TMI Action Plan Requirements of NUREG-0737.

The entire position for each item is provided in this section except in certain limited cases where figures from other sections are referenced.

In some

cases, the position stated in this section supersedes other sections of the FSAR.

All sections of the FSAR will be revised to be consistent with these pr,sitions but to the extent that inconsistencies may

exist, this section

governs,

/

l l

l l

l l

l l

L.

I.A.l.1 SilIFT TECllNICAL ADVISOR NRC Position Each licensee shall provide an on-shift (technical) advisor to the shift supervisor.

The shift technical advisor (STA) may serve more than one unit at a multiunit site if qualified to perf orm the advisor function for the various units.

The STA shall have c bachelor's degree or equivalent in a scientific or engineering discipline and have received specific training in the response and analysis of the plant for transients and accidents. The STA shall also receive training in plant design and layout, including the capabilities of instrumentation and controls in the control room. The licensee shall assign normal duties to the STAS that pertain to the engineering aspects of assuring safe operations of the plant, including the review and evaluation of operating experience.

LILCO Position LILCO will provide an on-shift (technical) advisor to the Watch Engineer provided the Watch Engineer is not fully qualified per FSAR Section 13.1.3.1.16.

The STA will be available within 10 minute notification. The STA will have a bachelor's degree in a scientific or an enginecring discipline or equivalent. The STA '.:111 receive the following training:

basic nuclear theory basic reactor theory basic health physics and shielding theory a

+ ther.aodynamics fluid dynamics

• heat Pransfer

• BWR nu-lear engineering (including chemistry, instruments, and controls) plant systems training accident / transient analysis

+ management and behavioral theory Certain portions of this training program may be waived for personnel who demonstrate adequate understanding of the required subject matter by examination of by experience.

Such waivers will be granted in writing.

The STA's primary responsibility will be to advise the Watch Engineer in the event of an accident or transient. The STA will be assigned other engineering duties which are compatible with his primary responsibility.

Included in these additional engineering duties may be:

. participation in an on-site safety review group l

+ evaluation of effectiveness of plant emergency l

and operating procedures in terms of terminating I

or mitigating accidents periodic evaluation and review of plant instructions and emergency procedures evaluation of core power distribution and thermal limits

• evaluation of NRC Licenseo Event Reports i

l l

l I.A.l.1-1 l

l

.~.u--.w w_-

x- ~ _

=-

=,

~.

SNPS-1 PbAR I.a.2.3 Aaministration or Training Program NRC Position Pending accreditation or training institutions, licensees and applicants ror operating licenses will assure tnat tralnu19 center and racility instructors wno teach systezas, integrated responses, tranolent, and simulator courses demonstrate senior reactor operator (dRu) quallrications and be enrolled in appropriate requallI1 cation programs.

l Tnis is a short term position.

In the ruture, accreditation or training institutions w111 include review or tne procedure Ior cert 1I1 cation or instructors.

Tne certirication or instructors may, or may

not, include successurui completion or an sko exano riation.

The purpose or the examination is to provide NhC with reasonable assurance during tne int.erim

perloo, tnat instructors are technically competent.

Tne requirement is dir acted to permanent rs >hers or training start wno teacn tne sun]ects enumerated anove,

eluaing members ut other organizations who routinely conduct training at the rac111ty.

Tnere is no intention to require guest lecturers wno are experts in particular subjects (reactc,r

tneory, instrumentation, tnermodynamics, health physics, enemistry, etc.)

to successtully complete an 3RO eu mination.

Nor is it intended to require a system expert, such as the instrument and control supervisor teacning tne control rod crive system, to sit ror an SRO examinatlan.

LILCO Position It is LILCO's position that permanent members or the training start wno teacn systems, integrated responses, or transients ne quallried or certirled to teach in the appropriate sunject area.

Tne quallrication or certirication or permanent lat:suners or the training starr may ne accomplishea by one or more or tne rollowing:

1.

Auproval ny an accredited training institution; or 2.

Successrut completion ot an dau certirication examination on an appropriate sizaulator ; or J.

successIul completion or an NRC dRU examination.

LILCO does not intend to rquire eitner guest lecturers who are experts in particular dutjects (reactor tneory, instrumentation, tnermocynamics, ne61tn pnysics, chemistry, etc.) to successrully I.A.2.3-1

SNPS-1 FSAR complete an NRC SRO examination; or system experts, such as an 2

instrument and control supervisor teaching the control roa drive system to successrully complete an NRC Sko examination.

f I

1 l

1.a.2.3-2 l

[

.--a....-

SNPS-1 FSAR I.C.2 Shift and Relief Turnover Procedures NRC Position The licensees shall review and revise as necessary the plant procedure for shift and relief turnover to assure the following:

1.

A checklist shall be provided for tne oncoming and offgoing control room operators and the oncoming shift supervisor to complete and sign.

The following iramsa, l

as a minimum, shall be included in the checklist:

a.

Assurance that critical plant parameters are within l

allowable limits (parameters and allowable limits shall be listed cm the checklist).

I b.

Assurance of the availability and proper alignment of all systems essential to the prevention and mitigation of operational transients and accidents by a check of the control console (what to check and criteria for acceptable status shall be included on the checklist).

c.

Identification of systems and components that are in a degraded mode of operation permitted by the l

Technical Specifications.

For such systems and components, the length of time'in the degraded mode shall be compared with the Technical Specifications action statement (this shall be recorded as a

separate entry on the checklist) ;

2.

Checklists or logs shall be provided for completion by the offgoing and oncoming auxiliary operators and technicians.

Such checklists or logs shall include any equipment under maintenance of test that by themselves could degrade a

system critical to the prevention and l

mitigation of operational transients and accidents or j

initiate an operational transients (what to check and criteria for acceptable status shall be included on the l

checklist) ; and 3.

A system shall be established to evaluate tne effectiveness of the shift and relief turnover procedure (for

example, periodic independent verification of system alignments).

LILCO Position Procedures to implement the intent of the ob-lectives described in Action Plan Item I.C.2 are included in the Station Operating Manual.

These procedures provide the means for the operating statt to possess adequate knowledge of critical plant parameter

status, system

status, availability, and alignment before the I.C.2-1

.... -.. - - ~ _. - -.

SNPS-1 FSAR watch is relieved.

This is done by requiring log reviews and equipment status turnovers as a

normal course of the relief process at each station.

l The required changes necessary to implement fully the objectives of Action Plan Item I.C.2 will be made to existing Station Procedures prior to fuel load.

These changes will provide for the required checklists or logs mentioned in items (1) and (2) above of the NRC position, as well as a system to evaluate the effectiveness of the shift and relief turnover procedures mentioned in item (3) of the NRC position.

t 1

1 I.C.2-2 1

~.

_._.-a--.___-__

_ _ ~..

, -. ~. - - - - -

SNPS-1 FSAR I.C.4 Control Room Access NRC Position The licensee shall make provisions for limiting access to the control room to those individuals responsible for the direct operation of the nuclear power plant (e.g.,

operations supervisor, shift supervisor, and control room operators),

to technical advisors who may be requested or required to support the operation, and to predesignated NRC persopnel.

Provisions shall include the following:

1.

Develop and implement an administrative procedure that establishes the authority and responsibility of the person in charge of the control room to limit access.

2.

Develop and implement procedures that establish a clear line of authority and responsibility in the control room in the event of an emergency.

The line of succession for the person in charge of the control room shall be established and limited to persons possessing a current senior reactor operator's license.

The plan shall clearly define the lines of comL'unication and authority for plant management personnel not in direct command of operations, including those who report to stations outside of the control room.

, LILCO Position A procedure to implement the intent of th'e objectives described in Action Plan I.C.4 is included in the Station operating Manual.

In order for the Shoreham facility to fully comply with the objectives of the Action Plan, a

revision to the Station Procedure is required to include in the overall scope of this procedure the existance of both a

Watch Engineer (Shift Supervisor) and a

Shift

Foreman, both of which hold a senior reactor operator's license and one of which will be in the control room at all times.

LILCO's position is that the required revision to this procedure will be made and implemented prior to Puel Load.

The Station Procedure, along with the required changes, is outlined below as it refers to the objectives of Action Plan Item I.C.4.

Authorization for Entry The Station Procedure contains a section entitled " Authorization for Entry" which establishes the authority and responsibility of the Watch Engineer to limit the access to the control room to that which is consistent with plant evolutions.

This section presently delegates this function to the Nuclear Station Operator (holder of a reactor operator's license and present in the control room) when the Watch Engineer is absent from the control I.C.4-1

SNPS-1 FSAR room.

This section will be changed to give the Shif t Foreman the command control function in the control room when the Watch Engineer is not in the control room.

Conduct of Personnel Durinct Abnormal Plant Conditions The Station Procedure also contains a section entitled " Conduct of Personnel During Abnormal Plant Conditionsa which establishes a

clear line of authority and responsibility in the control room in the event of an incident.

This section does this by clearly defining in broad terms what actions are to be taken and who is to take them (i.e., immediate and subsequent

actions, ensuring availability of an adequate heat sink to remove decay heat, safe shutdown of the main turbine and the balance of plant

systems, etc) to ensure reactor safety.

This section of the Station Procedure also delineates the lines of communication and authority of plant management personnel who are not in direct command of operations (including those who report to stations outside of a

control room).

This is accomplished by identifying the personnel who are responsible for the actions to be taken outside of the control room and the flow of communication will be from the Equipnent Operator (Auxiliary Operator in the field) to the main control room directly or through a

casualty control station outside of the main control room.

This section presently requires the Watch Engineer to take charge of the incident in the control room with the Nuclear Station Operator giving him a turnover in the event he is not present in the control room when the incident initiates.

Since the Nuclear Station Operator does not hold a

senior reactor operator's license and since either the Shift Foreman or the Watch Engineer will be required to be in the control room at all times, this section will be changed to have the Shift Foreman assume the command control function when the incident initiates in the absence of the Watch Engineer.

l 1

I.C.4-2 l

--.-_.~

.. ~...-. - --. _ _ -.

SNPS-1 FSAR I.C.5 Procedures for FeedDack of Operating Experience to Plant Staff NRC Position d

In accordance w..th Task Action Plan I.C.5, Procedures for Feedback of Operating Experience to Plant Staft (NUREG-0660),

eacn applicant for an operating license shall prepare procedures to assure that operating intormation pertinent to plant safety l

originating both within and outside the utility organization is continually supplied to operators and other personnel and is incorporated into training and retraining programs.

These procedures shall:

(1) Clearly identity organizatinal responsibilities for review of l

operating experience, the feedback of pertinent information to operators and other personnel, and the incorporation of such information into training and retraining programs; (2) Identify the administrative and technical review steps necessary in translating recommendations by the operating experience assessment group into plant actions (e.g., changes to procedures; operating orders) ;

(3) Identify the recipients of various categories of Inrormation trom operating experience (i.e., supervisory personnel, shif t technical advisors, operators, maintenance personnel, health physics technicians) or otherwise provide means through wnich l

sucn information can be readily related to the job functions of the recipients; (4) Provide means to assure that atfected personnel become aware of and understand information of suf ficient importance that should not wait for emphasis through routine training and retraining programs; l

(5) Assure that plant personnel do not routinely receive extraneous and unimportant information on operating experience in such volume that it would obscure priority information or otherwise detract from overall job performance and proficiency; (b) Provide sultacle checks to assure that conflicting or contradictory information is not conveyed to operators and other personnel until resolution is reacned; and, (7) Provide periodic internal audit to assure that the feedback program functions eftectively at all levels.

Each utility shall carry out an operating experience assessment function that will involve utility personnel having collective competence in all areas important to plant safety.

In connection with this assessment function, it is important that I.C.5-1

_._..m l

SNPS-1 FSAR procedures exist to assure that important information on operating experience originating both within and outside the organization is continually provided to operators and other l

personnel, and that it is incorporated into plant operating procedures and training and retraining programs.

l Those involved in the assessment of operating experience will review information from a variety of sources.

These include operating information from the licensee *s own plant (s),

publications such as IE Bulletins, Circulars, and

Notices, and l

pertinent NRC or industrial assessments of operating experience.

l In some cases, information may be of sufficient importance that l

it must be dealt with promptly (through instructions, changen to l

operating and emergency procedures, issuance of special changes to operating and emergency procedures, issuance of special precautions, etc.) and must be handled in such a manner to assure i

that operations management personnel would be directly involved in the process.

In many other

cases, however, important l

Inrormation will become available which would be brought to the attention of operators and other personnel for their general information to assure continued safe plant operation.

Since the total volume of information handled by the assessment group may be

large, it is important that assurance be provided that high-priority matters are dealt with promptly and that discrimination is used in the teedback of other information so that personnel are not deluged with unimportant and extraneous information to the detriment of their overall proficiency.

It is important, also, that technical review be conducted to preclude premature dissemination of conflicting or contradictory information.

LILCO Position Procedures to accomplish the general objectives of Action Plan Item I.C.5 are included in the Station Operating Manual.

The j

procedures for the feedback of operating experience and other l

1mportant information to tne appropriate Shoreham personnel are outlined below.

l I

1.

Ecedback of Information The Required Reading List is a primary means ror assuring that information essential to saf e and reliable operation of the plant is routed to and understood by the appropriate personnel.

The Required Reading List laay include, but not be limited to material such as facility design

changes, procedure changes, facility license changes, licence events reports, NRC I &

E information

notices, nuclear power experience, and NSSS and SOP equipment vendors correspondence.

The Plant

Manager, Chief Operating Engineer, Chief Technical

Engineer, and the Section tieads will inform the Training Supervisor of information to be placed on the Required Reading List and to which groups it should be routed.

They shall determine what experiences,

concerns, or other information I.C.5-2

SNPS-1 FSAR originating within the Shoreham facility are of sufficient importance to be included as required reading for plant personnel.

Technical information coming from sources outside Shoreham is subjected to a documented and controlled technical review cycle in accordance with Shoreham station procedures.

Appropriate Section Heads are assigned review responsibility of documents applicable to their area of expertise as part of the review cycle.

At this time they would make a determination whether a document is to be included on the Required Reading List.

It is the responsibility of the individuals listed above to limit the materials they submit for inclusion on the Required Reading List to essential information only.

They are also responsible l

for preventing the conveyance of conflicting or contradictory information to plant personnel before resolution is reached.

The l

Training Supervisor, who performs the actual documentation, l

control and routing of the list, will serve as a backup checx to l

prevent the routing of extraneous or contradictory materials.

i Normal routing in accordance with Shoreham station procedure gives all personnel on the list the opportunity to read and understand the materiaA within 30 days, by which time it should be returned to the Training Supervisor.

The Training Supervisor is charged with tne responsibility of assuring that the Required Reading List is completed in a timely manner.

The procedure also allows for alternate methods, such as supervisor lectures, staff

meetings, preplanned

lectures, etc.,

for the expeditious preparation of certain information requiring the special attention of station personnel.

2.

Training Revisions The Training Supervisor is responsible for coordinating the preparation and revision of training programs and lesson plans in accordance with Shoreham station procedures.

Section Heads provide recommendations and other input information to the Training Supervisor for the updating of training programs in their section's area or responsibility.

At such time they would recommend revision to incorporate the most recent operating experience or other important information into the lesson plans.

This material may also be inicuded in quizzes or exams as a check 4

to assure the eff ectiveness of the operat.ng experience feedback process.

3.

Station Procedures Revision A

Section

Head, Chief Engin eer,

or the Plant Manager may determine the need for revising an existing procedure or adding a i

new procedure based on pertinent operating experience assessments, NRC correspondence, manufacturers reconnuendations, or other applicable information.

Shoreham station procedures clearly define the methodology for achieving this objective.

I.C.5-3

SNPS-1 FSAR 4.

Review of Operatinct Experience The review of plant operating experience at the Shoreham facility is a

continuing function of the Review of Operations Committee (ROC).

The committee includes the Plant Manager as

Chairman, the Chief Operating Engineer and Chief Technical Engineer as Vice-chairmen, and the various Section Heads as regular members.

ROC advises the Plant Manager on all matters related to

past, present and future operation and all matters related to public safety.

The Review of Operating Com.nittec is an essential part of the plant review and audit program.

It ensures that operation is in conformance with the established operating procedures, license provisions, and quality requirements; it reviews changes in procedures, and changes in technical specifications which may constitute an unreviewed safety question as defined in 10CFR Part 50.59.

A continuing effort is performed by the Review of Operations Committee to direct and monitor plant operation, and to plan future activities.

I.C.5-4

SNPS-1 FSAR II.D.3 hellet and Safety Valves Position Incication NRC Position Reactor coolant system reller and sarety valves sna11 be provicea with a positive inalcation in the control room derived rrom a reliable valve position detection device or a reliable indication of Ilow in the discnarge pipe.

The paragrapns that rollow clarify the above position.

The basic requirement is to provide the operator with unamniguous indication of valve position (open or closed) so tnat appropriate operator actions can be taxen.

The valve position should ce indicatec in the control room and an alarm should be provided in conjunction with tnis indication.

Tne valve position indication may be sarety grade.

II the position incication is not safety

grade, a

reliable single-enannel direct inalcation powered from a vital instrument bus may be provided if backup methods or determining a valve position are available and are discussed in the emergency procedures as an aid to operator alagnosis l

or an action.

l Tne valve position indication snoula be seismically quallried consistent witn the component or system to which it is attached.

It also snould te quallflea ror its appropriate environment (any transient or acclaent wnich would cause tne reller or safety valve to litt) and in accordance with Commission order, riay 23rd, 1980 (CL1 'm-al).

It is important that tne displays and controls addea to the control room as a result ot this requirement not increase tne potential Ior operator error.

A numan-ractor analysis should ne perrormed taking into consideration:

l une use or tnis inrormation by an operator curing totn normal ana annormal plant conditions, integration into emergency procecures, 1

integration into operator training, ana 1

ocner alarms auring emergency and need ror prioritization or alarms.

LILCO Fosition Tnere are a total or eleven (11) dual runction saret.y re11er valves (SRV) in the snoreham xeactor System.

Tne SRVs 11.D.3-1 l

l

. :.. J. -. - -.. -

l

_. ~

SNPS-1 FSAR installea in tnis racility are of the Target Rock two-stage pilot operated design.

Direct main stem position inalcation is not accessible in a valve or this type.

Accordingly, positive position indication is provided utilizing pressure transmitters on eacn SRV discharge line.

Tne alscharge or each SRV is independently piped to approx 12nately rive (5) reet trom the bottom or the suppression pool.

The calculated steady state pressure near the valve discharge is in the range ot 300 psig when tne valve relieves at set pressure.

Tnis pressure is sufficiently high enat a positive ana unamoiguous signal is available with ample margin ror tolerances in callora non ana variance in line pressure.

hhen a

valve

recloses, pressure will return to normal in a Iraction or a second.

Thus, pressure measurement does not have the slow response time whicn characterizes alscharge pipe temperuture monitoring instrumentation.

Since each valve disenarge is inaependently

pipea, the pressure signal proviaes unique incication ror the associacc.a valve.

Nonredundant sarety grade instrumentation is provided to monitor pressure in the discnarge pipe or eacn dxV.

The transmitters are located in tne seconaary containment ana connected to the dRV discnarge piping ny instrument lines penetrating the primary containment.

Individual alsplay and trip set point instrumentation is provided ror eacn shV in tne main control room.

The range or instrumentation allows l

ror a trip setpoint or 10-50 percent or rated riow.

This gives a positive open position inarcation and also provides i

surricient sensitivity to detect a partially open shV.

A conanon alarm is also provided in the control room to promptly alert the operator wnen any SRV is open.

The display instrumentation is located as close as poesinle to tne SRV control station in tne main control room.

In adaltion to Deing qua1111ea for the environment - expecteo during events resulting in SRV alscnarge to tne suppression

pool, tne instrumentation meecs seismic Category 1 requirements in accordance with IEEE 344-1971 ana is powerea Irom a Class Ir., power supply.

l l

Tne exisung temperature monitoring instrumentatAon is retainea ror its original

runction, detection or valve leaxage concluons as nacxup/conrirmatory inalcanon ror the pressure instrumentation.

l II.D.3-2

SNPS-1 FSAR II.s.4.1 Containment Dedicated Penetrations NRC Position Plants using external recomniners or purge systems Ior postacclaent combusticle gas control or the containment atmcspnere shoulo provice containment penetration systems zor external reccaniner or purge systems tnat are cealcated to that service

only, that meet the redundancy and single-tallure requirements or General Design Criteria 54 ana 56 or Appena1x A to 10 CFx 50, and tnat are sized to satlary the riow requirements or tne recomniner or purge system.

components rurnished to satisry this requirement anall ne sarety grade.

Tne procedures zor tne use or combusticle gas control systems rollowing an accident tnat results in a degrudea core and release or radioactivity to tne containment must be reviewed and revisen, it necessary.

An acceptable alternative to the dedicated penetration is a i

comnined design that is single-fallure proot ror containment l

1 solation purposes and single-ra11ure proot ror operation or tne recumoiner or purge system.

botn the dedicated penetration or the combined single-tallure proor alternative anall be sized such tnat tne rlow requirements ror tne use or the recombiner or purge system are satisriea.

The design shall ce nased on 10 CFx 50.44 requirements.

Licenses tnat rely on purge systems as tne primary means ror controlling comnusticle gases rollowing a

loss-or-coolant dCC1 Gent snoula De aware or the positions taKen in 6tCY-80-399,

" Proposed Interim Amendments to 10 CFR Part 50 aelated to Hyarogen Control and certain Degraded Core considerations."

This i

proposed rule woula require plants that do not now have l

recomoiners to nave tne capacity to insta11 external recombiners by January 1, 19o2.

(Insta11ec internal recc4abiners are an acceptable alternative to the above.)

Containment attaosphere dilution (CAD) systems are considered to be purge systems ror the purpose or implementing tne requirements or tnis TMI Tasx Action item.

l l

l II.E.4.1-1

. _,.. _ _ _. m _.. -...

u -- _ _ _ _ _.. _ _ _ _.

SNPS-1 PSAR l

LILCO Position

)

1 The shorenda design presently incorporates renuncant exterral recomoiners for the control or combustible gases inside tne primary containment.

Two 100 percent capacity hydrogen recomoiners are currently installed.

The system is safety-related, Selstaic Category I and oesigned in accoraance witn AdMA III, Code Class 2.

The recombiners are located in the reactor Du11 ding outslae tne primary containment.

Four cedicated penetrations are provided zor each recomoiner as shown in Figure 6.2.5-1.

Tne Primary Containment Integratea Leak hate Test system uses the PCaC Containment Isolation System penetrations curing plant snutoown.

This coes not degrade the PCAC Contalrunent Isolation l

system, since the integrated Leak Rate Test bystem is always isoldten auring plant operation.

Two isolation valves are provided for eacn primary containment penetration in accoraance with the redunaancy and single rallure requirenenta or General Design Criteria 54 and 56 or Appena1x A to 10 CFR 50.

110 wever,

automatic isolation is not

proviaed, since all isolation valves in this system are closeo during normal operation.

The oesign is based on 10 CFR 50.44 requirements.

i

)

l l

s II.E.4.1-z

P

\\

3 k

,....m.

\\

\\

r

u.."2 egg.tg.

y n.,o,.a.

co.

-g fly t.c.

.c...

gg.n.att 70

%q

/y/

p

,c2.<

=' ~.e w='.

a

.f,,,,=co..

y.n oc..)q.

ONR.[.,

g2,%*" ;;.T'" ""' ' '"

. N,,,

f

_..., ce..... es..

C

...c.. "UW l' r.r _.-.-J*_a ;~m r_-. <,..>

=

r w..

r..... _

m.... a_.....-

cc.h~aC,. '-

.A,..

r.., _,

{es so,

39_

f 5-* ***

/ p*,,,l,y,#^

'd'h ("7 r*

m -

s

.,0s h e s.s strar.

ND o

e 1 bl ---

-(=.oc I

e e n.cc i *~'" 'i j

/

< g = - $-'em t...+ v L rg, g

uco

.a TY.x~U3 > > /. #.. _4 4.r,7' P 4-J g

1~

a

[wr, I

2..

I I

.o,e..

l

[<ts..w,_ _.}

l s

~

35**

• j j g

j s.

pas..oc -

I g

w a

I f 0'

rF in.

i I

cc i

i I o.k

=Wl'.','.S 1 C,

i

-yc=

rbrer i

P d

N tw,,,,, 7,}n ?y, &,iA. D

,,.3 i

.i<=- s -~ a 1 (bfit g

,c; e

y'Ta-'t 3tp q rc',

, ]l}

y.-.,

.ce.s.N, 1W

T.e'=m f

4 fe a

m a

7.,, m,,, _3gcw

• • • '****'5"*

re wa

.., <.. s.

ria as.s.ic s

g

,h, iP., f gc.,,,,,,

_ nus N,j

.u.-

3.,,,,

h!.

P j/[,f',

)

• $$y i

i4 3

49;

. s

.3 w*.,5.V. 3 c....

.w d;

v

_.y l,#dhcM.Iy, 3

(4r...n 4

.'1 u,.o,

.ps,v. jog ).

\\

y o.uc. -

47,494,f

• 9

'c'..'..*~ 0

<.y 48J8 g

, M,,,'.i,e,, *> 'ISI!--

g %(iaa > E,ld'pg *\\?J1 ia s

.e

';' *?a'.' *,

e a, nu ~.p

. > na Z

E

\\

~L 7Q' c,.3i:*.l' ',72.EA e ss4a-a N M:

M,m=,ssgyga; o~

i,==~j_

ory%e /p(L}[.. o

,m k.

-wwn, T 1

h M**-*

[ a.m.

5

.s l [',c"

g.,, +,

ss V

s s

.,p. 5.u as,

• G

,.., y 5 m m.<m

(.s..o 4S',7 y

v4 g,.,..,

e-.* Q su.wemo.. cot et.e

• ^ 28

\\

.Elo.

i ld" MT o

• >c =

_y,,,.

e.,

s........

l i

I l

/

\\

9

9 v

w -

f t

es)eg g r j=r g. 3.t

a. c.et t _.,.,_,..

sM 1s..

_.,4....

..m.-.

M gt Up.ae."C sIA4 (. Aki. D%e ms e 19 '% wh.et L.

pian,g.sg g e.g. ym.

.w4 un CL14 0.MS <., v a g,grg e esc.T.. Lputt 65 0' tee sk Gme% R s 95 1.ft wM7 GL.)C an,3 3.g emgeg. sf.

J 4 M.egfw af seOS 6 9 *.H9'prsit uhit 4 v.6,5 f W _ A #en W #t #* sAILE %4 *F O.f *** ) 'i4

( put8 af 3 To

• Cf 5 08*tJe. ga me. *rt se sape.f.

g g,,,g gg,,,gyg gg y,,g,,,g se,

e. J It f

'E D cm b

aa

• vsitt

.e.*4 e

g SkC f t)se '7 P.'t bedL6

..filf t. f3 ef E S GCC 2 g et E # f.6 8st f E.t. 4, 0

s '.e,3,g 3,

r3 3I'*.g,gg 3 es tet as.cet LL em.

?gD uns. wig bec,T@ E gLa-

-)as aa ess a mri****

seats S s.,0't,3 tr erwta e me.t m' 4 uss'.6ae.tarow" 6 ettiit0 n

8. soc e canew a a t p vt.s.w,w=.s,eo.a.r,e warv.=.,e o w.c,oe.re. s cm..

a a. t e.

pl

%E*h'* "'. 6 upts 70 SE [MeoC 4 WestESS M

B'8 5 j a-4.

10.u s.'F.enG 1D G.E,(DC.E CLA.%S.I bet.2 %%.C'*eement out*WO g QGg gCOs go 4 4 was : w atassum0 4 eWif to Cg.CE Ces m'n c.,30 sg to

.s.up e.M..an.ge.s.X.At. e se, e

.e i..

ocrAm 4 2. 3 it e s.uppt om.zie c.

(

.j.,

-.c.c co.,..,.v.oie.< ca.,.a sesrs.

. r.

• • =.e.*a er' *aar ce's setu e

.. uw m.m

• g

..c,_..,4.,_,s v

%..oc.:

• st 3a 3

, m.....

cg, ma u_

L s,.y,c.,,.,

_.<im aa 5 >. c ~==

rieuse tr.ia e.w.o,, s.oa dE55 L5a* * *> a

...c riov.se ir.ie m

aiou m

g,4 i

d gm c

.cn..Los

v. sa i-s aw top,6 to rt enas is as revat s13-se s

i

.t

\\

d

\\

g",

• - m.

c$

c,e.

.ica...

wi-na i

e i

gm

\\,

fay t+-ij Qwg.

,4 /

- g l...

Ji'i I m.a c

' Ic 4 ;a - a.

..,.a me s

j.

, c* c hs 3

k-gf; g(

g n j} wwn a y_

in. a m

r.t-

.=t. -

y 7r

.cos.,,8, m e

t,- =

J e a.*

p". %

t ;

j s

a

--g' ;

J a,-

aj l cu n.

I

@n-g u

3 a

5 5

y: =

g

~;,,,,,,

l N :~

'93 y *M J

L>

- -- - 2 M

T h

f^G Y

$7. 3,w, hh

[==

• 2*

,b N

[.

.,),)k p cI

- fo. W a 4

,[

N s+!-* *c" I

i vc=a n se g w u, a..

,.M., < --b s.

5 8 'c t

-.w.at Tt

'mh 7

8 trh Wi_. s:p,.,.,

5

• d,

/W4

.i Mr ^i

~*

( ~,. m,

1. .m ai s gy, atn.g ;v t.,

y il f. g'

/g.m. 4.,

J<

w, g"~']b.

.. a. a,

{

w ase-s*.

A nd, y

rm..m. M 2,,,,,,,,,,,,,,,.

nye. oc

).....,'!1 c ** W

• b d f'_" " '

$ ",*,.;'{,'"

F' ra

i. /.

z.

cm y3 22 ev q,. hq ~.e.

_a_.

c'.

g

<a y a

.-qp u

-t

, G.

=;

Lg "d

• 6s 60 s-2 f

y -

• r ) g

• +a,, %r g,;.(,, q,,.,,.,,,,

e

+ ~*

a u-

- c.a..oc.,

• D ' rese.

,i! @,"#'.*

4 s ar n s

\\

,h A..m.v.,

V U.a t,z 6

.va.w i=~ l

.9. s,s.es, LL L/

s to

..... i.;'ya w.,e, &..a l

m a ' " >

FIG. 6 2.5-I PRIMARY CONTAINMENT ATMOSPHERIC CONTROL SYSTEM SHOREHAM NUCLEAR POWER STATION-UNIT I k

FINAL SAFETY ANALYSIS REPORT s ;'

I f

b d

i

~ _ _

II.K.l.5 SAFETY-RELATED VALVE POSITION NRC Position Review all safety-related valve positions, positioning requirements and positive controls to assure that valves remain positioned (open or closed) in a manner to ensure the proper operation of engineered safety features.

Also review related procedures, such as those for maintenance, testing, plant and system startup, and supervisory periodic (e.g., daily /shif t checks) surveillance to ensure that such valves are returned to their correct positions following necessary manipulations and are maintained in their proper positions during all operational modes.

LILCO Position A review of safety related valve positions, positioning requirements and positive controls to assure that valves remain positioned in a manner which ensures the proper operation of engineered safety features was performed in response to I&E Bulletin 79-08, Item 6, and sent to the NRC by SNRC-455 dated January 2, 1980.

This review identified the four following areas:

1.

Motor Operated Valves (MOV) - All Category I MOV's have loss of control power relays which provide input to the following:

A.

Individually to the computer, B. To one of, or a combination of, system inop alarms, system degraded alarms, or loss of control power alarms.

Also, if an MOV has a given safety position and it is moved from that position and loses its ability to return auto-matically, then its respective system inop alarm is sounded.

To further back up the above statements, the NRC requested an audit of remote manual safety related valves via the Electrical SER open item 10 which was done and sent to them by SNRC-296 dated June 9, 1978.

Based on the results of the audit, it was concluded and has been confirmed that the existing position indication available is sufficient to ensure safe operation of the plant.

2.

Air Assisted Valves - All air assisted valves are designed to fail in their safety position upon loss of air or loss of electrical power.

3.

Modulating Valves - In some Category I process systems it was necessary to provide modulating control during a LOCA.

These valves use a 120 v AC or 125 v DC Beck actuator instead of instrument air.

There are two failure II.K.l.5-1

conditions for these valves:

A. Loss of control signal, B. Loss of electrical motive power.

On a loss of control signal the valves fail open, close, or as is.

On a loss of electrical motive power the valves fail as is.

The above failure positions for loss of control signal were determined so as not to cause a loss of system function.

If there is a loss of electrical motive power the redundant system provides safety function.

4.

Manual Valves - Manual valves are used extensively in Category I systems at Shoreham.

Due to their application (test connections, vent and drain lines, instrument root valves, sample connections, and maintenance isolation valves around components such as pumps and heat exchangers),

only certain valves have direct remote indication in the main Control Room.

I!owever, the operator can determine the positions of the majority of these valves indirectly by use of process instrumentation; e.g.,

pressure, flow, level, sump levels, etc.

In addition, administrative and procedural controls will be used to ensure proper valve position and, in some cases, the valves will be locked in their safety position.

A review of procedures to ensure that safety-related valves are returned to their correct positions following necessary manipula-tions is being performed together with the procedures review being conducted to verify that the requirements of I&E Bulletin 79-08, Item 8 (NUREG 0737 Item II.K.1.10), are satisfied.

The procedure reviews required by NUREG 0737 Items II.K.l.5 and II.K.l.10 and any necessary procedure changes will be completed by September 1981.

9 II.K.l.5-2

SNPS-1 FSAR II.K.3.15 Modify Break Detection Logic to Prevent Spurious Isolation of HPCI and RCIC Systems NRC Position The HPCI and RCIC systems use differential pressure sensors on elbow taps in the steam lines to their turbine drives to detect and isolate pipe breaks in the systems.

The pipe breax detection circuitry has resulted in spurious isolation of the HPCI and RCIC systems due to the pressure spike which accompanies startup of 1

the systems.

The pipe break detection circuitry should be 1

modified so that pressure spikes resulting from HPCI and RCIC system initiation will not cause inadvertent system isolation.

BWR Owners e Group Discussion The BWR Owner *s Group have reviewed this issue and agree that the current control logic could contribute to an unnecessary l

degradation of HPCI/RCIC System availability.

1 BWR Owners' Group Implementation Criteria Several design changes are capable of eliminating the unnecessary system isolations that can occur as a result of short term flow peaks in steam supply lines.

These changes include the addition of a time delay to the flow sensing isolation logic, the addition of snubber devices to the elbow tap instrument lines, raising the nominal setpoint, or addition of small diameter bypasses around the steam supply valves.

The BWR Owners' Group believe the addition of a time delay relay is the best solution because it directly addresses the problem of spurious isolation.

Furthermore, this change does not invalidate the design basis safety evaluation of this equipment, thus precluding the need to repeat any safety analyses.

LILCO Position LILCO endorses the recommendation ot the BWR Owners' Group to adopt a time delay relay scheme to eliminate spurious isolation of the steam supply line isolation valves during the system start sequence.

Due to the unavailability of qualified equipment,

however, implementation cannot be completed until approximately June, 1982.

1 i

l l

l l

II.K.3.15-1

ShPS-1 FSAR II.K..s.17 Report on uutage or t.CC Systems-Licensee keport ana Proposed Technical spectrication Unanges NRC Position Several components or the emergency core-cooling (hCC) systems are permitted ny tecnnical spectrications to nave sunstantial outage r t es (e.g.,

74 nours for one diesel generator; 14 days ror tne HPCI system).

In

addition, tnere are no cumulative outage time limitations zor ECC systems.

Licensees snould summit a report detalling outage dates and lengths or outages for all ECC systems for tne last 5 years or operation.

The report shoula also incluce the causes or the outages (i.e., controller tallure, spurious isolation).

Tne present tecnnical. specitications contain 11au.ts on allowable outage times ror ECC systems and components.

However, there are no cumulative outage time limitations on tnese same systems.

It is possible tnat m,CC equipment could meet present technical spec 1rication requirements but have a nign unavallanility necause or Irequent outages witnin tne allowable tecnnical specitications.

I l

Tne licensees snould suomit a report detalling outage dates ana lengtn or outages ror all ECC systems ror tne last 5

years or operation, incluaing causes or the outages.

This report will quantitication or historical provice the starr witn a

l unrellanility due to test and maintenance outages, which will be l

used to determine it a

need exists 'ror cumulative outage requirements in tne tecnnical spec 1rications.

l baseo on tne anove guicance and claritication, a detallea report l

snoula ne submitted.

Tne report shoula contain (a) outage dates I

ana duration or outages; (D) cause of tne outage; (c) ACC systems or components invoa.vea in tne outage; and (a) corrective action l

taxen.

Test and maintenance outages should ne included in the l

above listings wnicn are to cover une last 5 years or operation.

l Tne licensee snould propose cnanges to improve the avallan111ty l

or ECC equipment, ir needed.

App 11 cant ror an operating license shall estan11sh a plan to meet enese requirements.

LILCO Position since Shorenam is not yet operational, LILCO does not have any applicaole tCC outage inrormation to contrinute to proposing cnanges walen uaprove the ava11ac111ty or ECC equipment.

II.n.3.17-1

SNPS-1 FSAR I

II.K.3.21 Restart of Core Sorav and LPCI Systems on Low Level

_NRC Position The core spray and LPCI system flow may be stcpped by the operator.

These systems will not restart automatically on loss of water level if an initiation signal is still present.

The i

core spray and LPCI system logic should be modified so that these systems will restart if required to assure adequate core cooling.

Because this design modification affects several core cooling modes under accident conditions, a preliminary design should be submitted for staff review and approval prior to maxing the actual modification.

Modification of system design should be made in accordance with those requirements set forth in Sections 4.12, 4.13, and 4.16 of IEEE Standard 279-1971 with regard to protective function bypasses and completion of protective action once initiated.

BWR Owner's Group Discussion Control of BWR safety systems involves a combination of automatic and manual actions.

Although it might appear that additional safety system automation would be purely beneficial, it is the judgment of GE and the Owner's Group that the current low pressure Emergency Core Cooling System (ECCS) logic design represents a

balanced solution wherein there is sufficient automation for the short term phase of an incident with the longer term system control being dependent upon the manual actions of the plant operating staff.

Any fur *.her system l

automation should be measured against the penalties of increased system complexity, reduced system reliability and restricted operator flexibility.

For a complete discussion of the Owner's Group position, refer to l,

"BWR Owners' Group Evaluation of NUREG-0737, l

Item II.K.3.21."

BWR Owners

• Group Implementation Criteria The. current system design is adequate and no design changes are required.. This adequacy is based on several factors including the following:

1.

Comprehensive nature of BWR operator training 2.

Emphasis on reactor water level control during training 3.

Emergency Procedure Guidelines 4.

Relatively long time availsble for operator action 5.

Extent to which low reactor water level conditions are displayed and alarmed in the control room II.K.3.21-1

SNPS-1 FSAR Any further automation would unnecessarily increase system complexity, reduce system reliability and restrict operator flexibility.

LILCO Position LILCO endorses the position of the BWR Owners' Group not to modify the existing logic and controls for Core Spra y and Low Pressure Coolant Injection Systems to incorporate an automatic restart capability on loss of water level.

For supporting documentation refer to Attachment 1.

Note that the proposed modification to the HPCS system discussed in Attachment 1 is not applicable'to Shoreham since only BWR S and 6 (not BWR 4) have a HPCS system.

II.K.3.21-2

ATTACHMENT l' BWR OWNERS' GROUP EVALUATION OF NUREG-0737 ITEDi II.K.3.21 CORE SPRAY AND LOW PRESSURE COOLANT INJECTION SYSTEMS LOW LEVEL INITIATION i

4

-,n---..

r-....

..--r,

COATENTS

SUMMARY

1.

INTRODUCTION 2

2.

GENERAL E15CTRIC ECCS DESIGN PHILOSOPHY 4

i 2.1 LOCA Signals 5

l 2.2 Automatic System Initiation 7

2.3 Automatic System Termination 7

2.4 System Termination on High Level 8

2.5 operator Termination 9

2.6 Long Term Control 13 2.7 BWR Geometry Considerations 16 1

3.

TYPICAL EVENTS INVOLVING ECCS INITIATION 17 3.1 Event Description 17 3.2 Assessment 22 4.

CONCLUSIONS 28 APPENDIX A: HPCS DESIGN CHANGES 29 APPENDIX B: CORE COOLING CONSIDERATIONS 32 APPENDIX C: PARTICIPATING UTILITIES 34 i

NUREG-0737 ITEM II.K 3.21 CORE SPRAY AND LOW PRESSURE COOLANT INJECTION SYSTEMS LEVEL INITIATION

SUMMARY

The NRC has suggested certain modifications to the BWR Core Spray (CS) and Low Pressure Coolant Injection (LPCI) systems provided as part of the BWR ECCS network. These NRC duggestions center on control system logic modifications that would provide greater automatic system restart capability following manual termination of system operation. General Electric and the BWR Owners' Group have reviewed this issue on a generic basis and do not believe the NRC suggestions are required for plant safety considerations. This conclusion is based on the adequacy of the current ECCS logic design coupled with the potentially negative impact on overall safety of the proposed changes. For the low pressure ECCS these negative impacts include a significant escalation of control system complexity and restricted operator flexibility when dealing with anticipated events. Therefore, we conclude that no modifications be made to the low pressure ECCS with res'pect to automatic restart.

l GE and the BWR Owners' Group have evaluated a modification to the HPCS system I

which would automate its restart on low level following its trip by the operator. This change would make the HPCS restart logic similar to the HPCI I

logic which already permits an auto restart on low level. We have concluded that this change, although not required for safety reasons, would lead to a l

net safety improvement which could be implemented without adverse impact on system performance.

l This memorandum provides an overview discussion of GE's BWR ECCS design l

philosophy and presents the technical rationale for the OE/0wners' Group position on this issue.

l l

~..

1.

INTRODUCTION

~

This memorandum has been prepared in response to Item II K.3.21 of NUREG-0737.

In this Item, the NRC suggested certain modifit.ations to the Core Spray (CS) and the Low Pressure Coolant injection (LPCI) Emergency Core Cooling Systems (ECCS) that are provided as part of the BWR ECCS l

network. The NRC suggestions center on incorporating additional control system Icgic to provide automatic system restart from a low reactor water

~

level signal following actions by the operators to terminate system operation. The NRC concern is that the reactor operators nay terminate ECCS operation when a hign reactor water level condition exists but may neglect to reinitiate the systems if a low level condition recurs.

General Electric and the BWR Owners' Group have reviewed the current CS and LPCI system for the plants identified in Appendix C and have concluded that overall BWR safety would not be enhanced by the type of control system modification suggested by the NRC. This memorandum describes the current CS and L?CI logic design and provides the technical rationale for the GE/0wners' Group position. This discussion it generic and includes the LPCI and both the low and high pressure core spray systems i

j (LPCS/HPCS). There are some plant to plant variations in these systems but these variations are not important to the overall technical conclusions presented in this memorandum. Neither the High Pressure Coolant Injection system (HPCI) provided on some pre-BWR/S reactors nor the Reactor Core Isolation Cooling (RCIC) system is discussed.

Section 2 of the memorandum describes the major elements of the GE ECCS design philosophy that are relevant to any discussion of providing expanded system automatic restart capablity. A full understanding of the significance of CS and LPCI logic changes must be based on a recognition that these systems are part of the interdependent BWR ECCS network; any changes in one system must consider the possible interactive effects amongst the other systers making up the overall ECCS network. This must also include the potential impact on supporting systems such as the standby power supplies and the emergency service water systea. i

Furth:rmoro, tha LPCI system is o sub-cystem cf tha R:siduni H20t Removal (RHR) system which has other safety related functions such as suppression pool (containment) cooling and containment spray. Clearly, these other safety functions must not be compromised by any changes in the LPCI mode of operation.

Section 3.1 describes the sequence of events that would occur during several key reactor system transients. This information is for typical BWR transients and identifies system actions which occur automatically and also what operator actions are required. The intent of these generic event descriptions is to illustrate the adequacy of the current BWR ECCS design and to support the position that no modifications are required on the basis of any safety considerations.

l Section 3.2 identifies the points in the transient events where inappropriate operator intervention and errors have the potential for l

leading to inadequate core cooling. These conditions are reviewed and it is concluded that in no case does the probability for error warrant any ECCS control logic change.

Furthermore, the safety margins incorporated in the BWR design provide considerable time between the point at which the operator should (but does l

(

not) take action and the time at which core cooling would be jeopardized.

l Typical BWR data is provided in Appendix B.

l An i:portcst point cf desiga philestphy is involv;d in tha discussicas presented in this memorandum. Control of BWR safety systems will always involve a combination of automatic and manual actions; the issue raised by this NUREG-3737 Item is simply where and how to define the boundary between these two control methods. The current GE ECCS designs are based on the approach that automatic system initiation is required during the short tegn phase of any incident but that longer term system control can and should depend upon the manual actions of the plant operating staff.

Intuitively, it might appear that additional ECCS automation would be purely beneficial since this would supposedly provide added protection against operator errors and omissions. However, these perceived benefits of extended system automation must be measured against the very real penalties of increased system complexity, reduced system reliability and restricted operator flexibility for dealing with unanticipated events.

These considerations are not amenable to precise quantification and control system design decisions must of necessity involve judg-ments as to i

relative importance of these competing influences. GE and the BWR Owners' t

Group believes the current BWR low pressure ECCS logic design has i

considered all of these factors and represents a balanced solution.

GE and the BWR Ownera' believe that the current BWR 5/6 High Pressure Core Spray (HPCS) system is fully adequate and no design changes are required on a basis of any safety considerations. However, there are relatively straightforward HPCS design modifications that would automate the restart of HPCS on low level following its trip by the operator similar to the HPCI logic. This change which would enhance overall plant safety is described in Appendix A of this memorandum.

l 2.

GENERAL ELECTRIC ECCS DESIGN PHILOSOPHY This section provides an overview discussion of the generic GE ECCS design philosophy and design practices as they govern ECCS initiation and operator control of these systems. ECCS control systems must satisfy multiple system design requirements and the information presented in this Section and Section 3 is intended to demonstrate that the current ECCS controls are based on a balanced consideration of these multiple requirements. -.

2.1 LOCA Sinnals High drywell pressure

• and low reactor water level ** are the key accident related parameters that govern operation of the BWR ECC systems. The occurrence of either or both of these signals is taken as an indication that a Loss of Coolant Accident (LOCA) has occurred.

This combination provides diversity of initiating signals but it is important to note that the control system hardware does not disc'riminate between signals generated by the drywell pressure sensors and those produced by the reactor water level instruments.

Either or both of these sensed variables can produce a LOCA signal input to the control circuitry.*** The latter does not treat the signals separately and there is currently no way for the control hardware to recognize which parameter is indicating a LOCA condition exists.

This is a significant design feature because it means system logic reset cannot be accomplished until both of these LOCA signals have cleared: and an ECC system cannot be returned to its true standby mode until the logic circuits have been reset. With the current design, automatic restart of any ECC system will occur once it has been placed in the standby condition and an initiation signal recurs.

As discussed below, there are in practice many BWR accident sequences where one or both of the ECCS initiation signals will persist for long periods of time. This characteristic complicates any scheme to provide the type of system restart proposed by the NRC.

Typically 2 psig.

Actual setpoints are plant and system dependent. All setpoints are above the top of the active core.

Common LOCA logic is developed within each redundant ECCS division, so the core spray and LPCS controls receive the same signal at the same time.

Tha Icts tcru post-LOCA treasic2t 10 good cxamplo cf tha significerca of the combined drywell pressure and reactor water level LOCA signal input to the BWR ECCS. For all but the largest breaks, reflooding of the core will occur relatively soon after the ECCS have been automatically started by the high dryvell pressure and/or low reactor water level signals. However, the high drywell pressure condition may persist for extended periods following the accident and the continued presence of this LOCA signal will prevent ECCS logic reset and thus prevent return of these systems to their standby mode.

Control system modifications to provide automatic restart on low reactor water level would have to be based on logic that recognizes the possibility of a continuously present drywell pressure signal.

The possibility for the drywell pressure signal not being present would also have to be included in the logic; longer term post-LOCA containment pressure conditions are sensitive to factors as break size, break location, type of ECCS equipment operating, etc. and pressures botn above and below the 2 psig value could occur depending upon plant conditions.

In summary, the diversity of initiation signals is an important design philosophy that has had a major influence on the current BWR ECCS control system design. However, the BWR LOCA performance is such that one or more ECCS initiation signals can persist for extended periods of time. Any scheme to provide ECCS automatic restart capabilities would have to be complex in order to deal with this possibility. The added safety benefits of an automatic restart design must be balanced against the dacreased reliability of the system brought about by the additional control system complexities required to implement the change.

l Sections 2.3, 2.6 and 2.7 provide further discussion of this point.

J

}

2.2 Automatic System Initiation Lumediately following a LOCA that produces either high drywell pressure or low reactor water level, all BWR ECCS will automatically start. Injection of emergency cooling water into the reactor will occur when reactor pressure is within the design range of each particular system. This design feature would not be inf1"uenced by any plant modification to provide ECCS automatic restart capability.

Annunciators are set off by the initiating condition and are subsequently acknowledged by the plant operators. The audible alarm is silenced by the operator after he has acknowledged the conditions and determined his required action but the panel light persists until the originating condition disappears. Reoccurrence of the originating condition would cause a new audible alarm and alert the plant operators to the need to reactivate any secured pumps and restore reactor water level. These important control room annunciation / alarm features of the typical BWR together with the BWR reactor water level indicators will provide information that will ensure that the control room staff is continuously aware of the reactor water level condition and will undertake all the necessary safety actions in a timely manner.

2.3 Automatic System Termination The low pressure emergency systems do not stop automatically in the event either the drywell pressure or the reactor water level signals return to non-LOCA conditions. See Paragraph 2.4 for high water level trip of the HPCS system.

In come plants, high-high ec:Itciament system pressurco will ecusa

~

a portion of the LPCI system to automatically realign to the containment spray or vetwell spray : node of operation.

(Some time delay is provided to allow reactor water level recovery). This design feature is intended to enhance the ability of the pressure suppression containment system to accomodate steam bypass of the drywell/wetwell vent system. Reoccurrance of the LPCI autostart sign'al would create conflicting simultaneous automatic signals which would have to be resolved by a priority logic and its attendant complications.

2.4 System Termination on High Level In general, flow from the High Pressure Core Spray (HPCS) system is terminated when a high reactor water level condition occurs (typically referred to as Level 8). The intent of this control feature is to prevent unnecessary flooding of the reactor vessel and steamlines. Termination of HPCS injection can occur either automatically or by operator action.

In the event of the former, the HPCS system will restart automatically if and when reactor water level decreases from the high level trip point to the low level initiation setpoint.. _..

Dependicg cpos tha circumstc2 css involv;d, cutomatic rcstcrt ecy or may not occur following operator termination of the HPCS system.

~

(See Socion 2.5 for additional discussion _ ) It should be noted that the Reactor Core Isolation Cooling (RCIC) system is also available for high pressure reactor water makeup dut'y and can be considered a diverse backup for the HPCS. (See Note 1) 2.5 Operator Termination The reactor operators can, at any time, stop any BWR ECCS system even if a LOCA signal is present. This manual override option is l

I deliberate and is considered by General Electric to be an important safety feature of the BWR ECCS network. This feature provides the plant operators with flexibility for dealing with unforseen but credible conditions requiring a particular system to be shut down.

Exsmples would be equipment difficulties involving gross seal leakage, breaks in ECCS piping, failed ECCS pump motors, load shedding for other post-LOCA operations etc. General Electric strongly believes that any design changes which restrict this operator flexibility would not be beneficial and would not lead to improved plant safety. Becauce the reactor water level is direc'tly measured in the BWR and the water level is a primary parameter in the operator guidelines, operator action is a highly reliable means of reinitiating low pressure ECCS if needed to assure adequate core cooling.

It is believed the overall system reliability is higher if flexibility is included for operator action as compared to a system which cannot be overridden if a LOCA signal is present.

(NOTE 1: The BWL1/6 HPCS control logic currently includes a high drywell pressure override of the high level flow termination signal, i.e., if a high drywell pressure signal is present, the HPCS system will not terminate on high level and will flood the reactor and main stesmiines. General Electric believes overall plant safety would be improved if this override feature were removed and is currently reviewing such a change with the NRC staff.)

9_

Dependirg spos the rccctor ecidition, cp;rcter tcrainatics cf o BWR ECCS can be achieved in several ways. Figure 1 is a schematic diagram which illustraces these options for typical low pressure systems. The schematic in Figure 2 illustrates the logic for the BWR/5 HPCS system. The key points to note are:

1.

If properly secured and returned to the standby mode, all ECCS

'will automatically reinitiate if a LOCA signal re-occurs.

Standby status can be acheived when all previous LOC'A signals l

have cleared and the sytem logic has been reset. Correct operating procedure would be for the operator to attempt to return all ECCS to their standby mode any time a system is being secured; only when conditions such as the continued presence of a LOCA signal prevent this operation would a system be stopped and left in a non-standby mode.

2.

If a LOCA signal persists, system flow can be terminated but the system cannot be returned to standby status. A typical ECCS system logic permits the operator to override the incoming automatic start logic (from the persistent LOCA signal) by use of either the "stop" position of the pump manual switch or the "close" position of the system injection valve. Momentary contact of either switch actuates logic elements which block the incoming automatic initiation signal. Once blocked, the automatic signal no longer controls pump or valve action and any subsequent system operation will be dependent upon manual operator actions.

3.

An improperly secured system (eg: an injection valve closed but system not returned to standby mode) will not automatically restart if a LOCA signal reoccurs.

OPERATOR TERMINATION OF BWR EMEPGENCY CORE COOLING SYSTEMS:

A SCHEMATIC SHDWING TYPICAL OPTIONS OPERATOR DECIDES TO STOP AN ECCS EC

• Y m

@E$

NO LOCA ONE OR BOTH LOCA SIGNALS 5 Pn m SIGNALS PRESENT.

(THIS CONDITION

• IO W PRESENT IS LIKELY FOR MOST ACCIDENT lEs SITUATIONS

~

i E -i B

• WC 5e5 SS" d

U SYSTEM FLOW STOPPED BY D

OPERATOR CLOSING INJECTION m

OPERATOR CLOSING 5

SYSTEM FLOW STOPPED.

VALVE AND/OR STOPPING PUMP INJECTION VALVE

{

LCGIC RESET.

SYSTEti AND/0R STOPPING PLACED IN STANDBY MODE PUMP. OPERATOR I

DOES NOT FOLLOW h"

GOOD UPfRATING SYSTEM CANNOT BE PLACED IN 5

PRACTICE AND DOES STANDBY MODE l

8 NOT RESET THE SYSTEM LOGIC

__\\

A YES NO j

I h

WILL AUTO RESTART OCCUR IF A t;

LOW LEVEL SIGNAL RE-0CCURS?

i I

um

\\

$5 55

<m

• 0PERATOR RESPONDING TO EITHER A MALFUNCTIONING SYSTEM OR A NEED TO INIT OTHER SAFETY RELATED FUNCTIONS (EG: ESTABLISH SUPPRESSION POOL COOLIN FIGURE 1 00 l

C E, w

_u J

c m

h.

Nwa 1[*E Eof d

bzb E

r=C=

gg-U C

E E

O E *C zr

&w&

Cz

.C r M

• • w OC m J

zM w>z AaJ 4

=*w 4h. m -

JA J

<z^

E Cw w

s Ce 3 V.*

nm C*

4 m

l 3

4 en

.Jr ow mwu te te J C2 WQCr C

Ww J G.

r 6 QC W r

r>

et Ch. m

.O aIC W 1* r W

Je C

3J

• =. O C CE wz w

Ezz Ce DC Z DC

• =o r U wO J Q.

lA C t.D wmeQ W w ec 3 0 e

'3 x r-C Ct:

C O

I4 W u c Um 4 *=-

.C EECwmJ z

-M z

WC C

o. w

' :e Ez W

CCE OC z Qw 3C E z* o 3 z e

r v-

o o z

LaJ Q 8 C m.

U.r ey

• U o.

2 z>

oc

& z e28 o sa-e < m w

o o r e--

E

> cc oc -

z r oI 5.o.

n.

.c =

r-

.e c

m m

C to WM aC E a: v

.z W

z C

n.

- w oz re r

.c - E a

m r

x me a m

<=

-mz w

mm E

EE5 "E

~

m mm au W <w Wr z z J =c o

- in ac ce wo

-w Es

-

E

a. w C.e M

TJ6 z

u

. -.o o

-e

= e.c- -

.c o z.

E e

M e-

< E +m-o um

< m e-wc v4=

a: e o<w o

co Jzm e-z ew

.c o 4 o - cc aed w>

m e n.

wo.

LaJ oma W

o a. z xzo SMY1S SNOI13V B01VM3d0 SMY15 IBV1538 010V TVNDIS V30'1.. _ _. _ _ _ _ _ _ _ _, _ _ _ _ _. _ _

2.6 Lona Term Control BWR emergency system design is based on the assumption that long term control of the reactor will be completely dependent upon operator actions. This long standing design philosophy has been consistently applied to reactor control following both non-LOCA transient events (such as turbine trip) and also to the complete spectrum of credible loss of coolant accidents. A good example of this philosophy is the comp'lete manual control.of the multiple operations required to establish the long term post-LOCA containment cooling functions.

Post-LOCA containment cooling is a key safety function since it pre,ents containment overpressurization and is thus required to support long term cooling of the core.

Providing purely manual control of the long term BWR transients is based on the thesis that the operator will ensure continued core cooling. This manual approach is considered superior to providing the very complex equipment and controls that would be necessary for comprehensive automatic ECCS restart capabilities during these transients.

As an indication of the potential complexity of the control systems that would be required, the following are some of the major long-term transient considerations that would have to be accounted for.

1.

In many cases, the station standby power sources do not have sufficient capacity to permit all emergency systems to run simultaneously. The plant operators must establish priorities and make the necessary power assignment decisions. An example of this process would be the decision to shut down one or more of l

the multiple ECCS in order to provide power to the emergency service water pumps. This is clearly an appropriate action for the operators to taka since the multiple ECCS will be providing redundant core cooling and the essential service water system must be activated if the containment cooling and pressure control functions are to be established.

Any s hema to citamatienlly rcetcrt tha ECCS is o vcesal injection mode would have to recognize and account for these other essential post-LOCA activities as well as recognize unavailable or failed systems and equipment.

~

2.

For many plants, operator action is required to ensure adequate ECCS pump Net Positive Suction Head (NPSH) during events involving elevated suppression pool temperatures. In most cases, automatic ECCS system initiation does not involve any system flow control. Consequently the system wi11 operate at the nazimum flow rate as vessel pressure reaches drywell pressure. This operating mode is usually referred to as the run out condition and it involves the most severe NPSH requirement at the pump suction. NPSH conditions can (in some cases) lead to pump cavitation as the suppression pool water temperature increases.

These undesirable NPSH situations are avoided by the plant operator manually adjusting the system flow rate to design values. Again, this aspect of design would have to be accounted for in any scheme to provide auto-reinitiation capability.

l 3.

Many BWR transient and accident events involve significant release of reactor system energy to the suppression pool which increases the pool temperature and containment pressure.

Control of these temperature / pressure conditions is achieved by manually placing the LPCI/RHR system in the suppression pool cooling mode. This LPCI/RHR mode, in conjunction with emergency service water system operation, permits rejection of the excess suppression pool energy to the station ultimate heat sink. Much of the equipment used for this cooling function is also used for the LPCI ECCS mode of the RHR system. Any scheme to provide automatic initiation of the LCCS system would either have to bypass the LPCI system after it has been assigned to the suppression pool cooling function or automatically realign the equipment to the LPCI mode. --

Consid;rcties of tho sac 0cd eptica previdas a good cxamplo cf tha many practical difficulties associated with rectroactive modification of BWR ECCS systaus. Automatic realignment of the RER system from the suppression pool cooling mode to the LPCI mode would have to recognize the "as-built" characteristics of the hardware involved. For example, the typical RHR pool return f

line valve is a 12 - 18 inch valve which would require 90

'seconds to close whereas the LPCI injection line is a 12 - 24 inch valve which would open in 24 seconds. This represents s 3:1 valve closure period mis-match and any simultaneous signal to realign the RER system would result in a significant period of time during which the RER pump would be supplying flow to both flow paths. The RHR pumps are not designed for the excess duty associated with this mode of operation: inadequate pump NPSH, pump motor overloading and auxiliary power source overloading are potential problems that would have to be addressed. Clearly, these types of hardware problems are not insurmountable but would have to be addressed as part of any rectroactive ECCS modifiction program.* The intent of this discussion of potential difficulties is not to suggest that rectroactive ECCS system logic changes are impossible but rather to highlight the non-trival hardware changes that may accompany any control system l

logic redefinitions.

Additional logic to tvoid the valve timing mismatch requires additional LPCI valve permissives and so adds to the probability of failure.

l 1

2.7 BWR Geometry Considerations That Impact System Loric The BWR core and internals configuration are such that certain design basis break locations and sizes do not permit complete post-LOCA reflooding of the core. For jet pump plants, very large ruptures in the external recirculation system pipe allow the ECCS to reflood the reactor vessel only to the ele <ation of the jet pump suct' ion plane.

This elevation is at approximately 2/3 of the core height. However, the" actual water level inside the shroud is considerably higher due to the existence of voids. For non-jet pump plants large I

recirculation line breaks do not permit full reflooding of the core.

Adequate core cooling is achieved under these conditions for either reactor type but the reactor water level can never be restored to the ECCS initiation level.

This characteristic complicates any scheme to provide automatic reinitiation of the ECC systems on low water level. For large breaks in jet pump plants, inadequate core cooling would probably have to be defined so as to be based on the 2/3 core height level. This revised definition would have to be in addition to the current initiation level which is conservatively identified as a water elevation above the core. It is not clear what comparable alternative signal could be used in the case in the non-jet pump plants. However, it is believed that the minimal need for (and benefits of) providing automatic ECCS reinitiation for large BWR recircu'letion line breaks does not justify the penalties associated with the significantly more complicated control system that would be required. In summary, the current ECCS logic is well suited to the BWR geometry characterisites and no changes are required on the basis of the inadequacies in the et. rent design.

I i,

l l

1 t.

3.

TYPICAL EVENTS INVOLVING ECCS INITIATION 3.1 Event Description Typically analyzed BWR LOCA and non-IDCA events are discussed in this

~

Section of the memorandum; the events have been treated generically.

In each case the emphasis is based on interactions between the LOCA l

signal and the actions the plant operator can or must take to ensure safe plant conditions. The event descriptions are based oc current ECCS control system logic.

The following events have been selected as representative BWR transients:

1.

A design basis recirculation line break which will not permit reflooding of the core above the 2/3 core elevation. This accident is included as a base case to illustrate the reasons for l

the existing system logic.

l 2.

A anall break not involving significant loss of reactor water i

inventory. This accident will lead to high drywell pressure but not a low reactor water level ECCS initiation signal.

3.

An intermediate size loss of coolant accident that involves some core uncovery but with a subsequent reflooding of the reactor by the ECCS.

4.

An upset transient that produces a momentary reactor water l

reduction and thus HPCS initiation on low water level but no high drywell pressure LOCA signal.

Tables 1 through 4 show the major sequence of events for these four l

i transients...

TABLE 1 TYPICAL BWR TRANSIENTS CASE 1: DESIGN BASIS RECIRCULATION LINE BREAK SEQUENCE OF EVENTS

- Break occurs

- High drywell pressare signal These signals will persist

- Low reactor water level signal indefinitely and cannot be reset.

- All ECCS start and inject water into the vessel automatically

- Core heat-up terminated, all FCCS running, core flooded to 2/3 height.

In some cases, part of the LPCI flow may automatically be diverted to containment or wetwell spray.

END OF SHORT TERM BLOWDOWN PHASE OF ACCIDENT Core

- Multiple operator actions to establish long term post-LOCA core and

ooling containment cooling. Actions include some ECCS termination, standby Nwer ispsndentj upon reassignments, emergency service water startup, actuation of suppression 3Perator pool cooling, pump throttling to assure adequate NPSH, elimination of actions s

unnecessary ECCS pump operation so as to minimize pump heat input to the suppression pool etc.

I I.

TABLE 2 TYPICAL BWR TRANSIENTS CASE 2: SMALL BREAK NOT INVOLVING IIGNIFICANT LOSS OF REACTOR INVENTORY (BWR 5/6)

SEQUENCE OF EVENTS

- Break occurs

- High drywell pressure signal - signal will persist indefinitely

- No low reacter water level

- All ECCS start automatically (Iow pressure systems will not inject because of high reactor pressure) s 0+

- HPCS Injection g

- HPCS flow terminates auto-

- Operator observes increasing natically on high level reactor water level and (Level 8) (assuming deletion of terminates HPCS by stopping high drywell pressure inhibit pump or closing injection for BWR/6) valve. This action precludes subsequent automatic initiation on lov level

-HPbSautorestartson

- Subsequent HPCS restart initial level (Level 2) requires operator action.

Because of persistent high

- Continuous automatic drywell pressure, system reactor water level control logic cannot be reset and system returned to standby END OF SHORT TERM PRASE OF EVENT

,' Core

'- Multiple operator actions to inititate orderly shutdown of reactor.

! cooling Depending upon equipment availability, heat rejection will be to main dspsndant( condenser, suppression pool, or normal shutdown path. Considerations will lSPon f be to establish core and containment cooling, assure adequate power supply

' CParotor distribution, start emergency service water pumps, throttle pumps to assure cetions,

adequate NPSH, etc.

l l l

~

TABLE 3 TYPICAL BWR TRANSIENTS CASE 3:

INTERMEDIATE LOSS OF COOLANT ACCIDENT JEOUENCE OF EVENTS

- Break occurs

- High drywell pressure signal.

(This signal will persist indefinitely)

- Low reactor water level signal. (Level will be recevered at some point in the accident)

- All ECC systema start automatically

- Core uncovery/heatup transient terminated. All ECCS running, reactor vessel flooded. In some cases, part of the LPCI flow may be automatically diverted to containment spray.

END OF SHORT TERM PHASE OT ACCIDENT Core cooling dsptndsnt

(- Multiple operator actions essentially same as those identified in Table 1 upon

/ for the Design Basis Acciden't (DBA) operctor cetions l

l

~~..._~_c.._

.~

TABLE 4 TYPICAL BWR TRANSIENTS CASE 4: UPSET TRANSIENT (BWR 5/6)

SEQUENCE OF EVENTS Upset event Low reactor water level signal occurs (either due to loss of feedwater or because of momentary level reduction due to void collapse). High drywell pressure does not occur.

High pressure system starts and injects Reactor water level increasing [QAy HPCS flow terminates

- HPCS flow terminated by automatically on high level operator. Logic cleared, system returned to standby mode HPCS auto restarts when

- HPCS auto restart if initiation level reached initiation level reached Continuous automatic reactor

- Rr. peat of cycle. Continuous I

level control automatic reactor level control E D OF SHORT TERM PHASE OF EVENT l

Multiple operator actions essentially the same as those identified in Table 2 l

,r_.---------

--,-,,,n_-

................-..=.-,....-.:--

~~--.:----_

3.2 As ses sment The thrust of the NRC position as stated in the NUREG-0737 Item can be summarized as follows:

Is it possible that the plant operators could stop an ECC systen at a time and in a manner that would, unless the systen is 6

manually restarted, lead to inadequate core cooling? If this is the case, and since there is a remote chance the operator may not restart the system, restart should be made automatic.

The simple response to this position is that the current BWR ECCS design does indeed permit the plant operators to terminate system operation in a way that would eventually jeopardize cooling of the core assuming the operator ignors the water level instrumentation and procedures. However, a review of the particular circumstances that would have to be involved leads to the conclusion that this is not necessarily an unacceptable situation which must be immediately remedied by providing additional ECCS automation. To support this position, the typical generic events described in Table 1 through 4 have been subjected to the following questions.

l

- What operator actions are required?

- What deleterious operator actions are possible?

- Could the deleterious operator actions lead to degraded core cooling?

- Is an ECCS logic dorign change required to protect against the possible operator errors?

l Table 5 summarizes the response to these questions for the four typical generic BWR transients described in Section 3.1.

A review of Table 5 shows that the current ECCS control logic coupled with reasonabale operator actions provides adequate core cooling throughout the four typical events presented. However; there are three general circumstances where it is possible (but not probable) for operator errors to produce conditions that could potentially lead to degraded core cooling. These conditions are:

1 l.

1.

Delib:rcto ep;rotcr tcominatics of multiplo BCCS durirg tha earlier phases.of an incident when the sytems have been automatically initiated.

In general, automatic restart will not occur because the initiating signals (high drywell pressure and low water level) will still be present and will preclude the system logic reset. The ECCS logic design which permits operator intervention is based on a legitimate assumption that the operators are not likely to prematurely terminate ECCS flow and jeopardize the core cooling process.

In actual practice, one of their highest priority activities will be to assess the situation l

to assure all emergency systems have started correctly and attempt to start any that may not have. The alternative to providing this operator flexibility would be to design the system so that any termination attempt by the operators would be overridden. This is not considered good design practice since it provides no flexibility for the operator to deal with unanticipated situations in which overall plant safety may be increased if a malfunctioning ECCS system can be shut down. An example of the latter would be to secure a system that has gross seal leakage that could potentially flood an ECCS compartment and deplete pool water.

2.

A second general circumstance during which errors and omissions could potentially lead to degraded core cooling conditions would be a failure of the operators to adequately consider core cooling requirements during the long term period. During this longer l

term phase, the plant operators are manually setting up the auxiliary systems to support eventual termination of the I

incident. In the event of degraded core cooling, automatic ECCS initiation is unlikely to occur because the systems will not be in a true standby mode. Consequently, adequate core cooling is I

dependent upon correct operator actions.

l l -__

o& h>

ll&

6 Al

1. +s%

$<jNN Nv' '

IMAGE EVALUATION TEST TARGET (MT-3) 1 1.0 lsenm

.:u p'=

E Ra l,l hN

.8 1.25 IA 1.6 i

/

6"

[%i

/#

• f/ b tQ*(O

%s///

a 4

1. d,b)*

k.k TEST TARGET (MT-3) l.0 E m L23 g a gp-m c

l,l

• OllN 1.8 1.25 l 1.4 1.6 6"

wy%,,

1. > A.

A 4%

< e,,

Q 44%

ms 6,bq fs v

ff 0

({&

l

l Agnis, this capect of ECCS design is c;esid:r:d fally ccerptcbio because of the time available between attaining level one and the occurrence of high fuel clad temperatures.

(See Appendix B) The operator must take manual control of all systems during this period and it is not considered credible that he would provide inadequate cooling to the core. As discussed in Tab 1'e 5, the alternative would be to provide the complex logic necessary to

'automaticaly restart certain ECCS. This would involve a major escalation of control system logic complexity and the benefits of added protection against unlikely operator error do not appear to compare favorably with the penalties of increased control system complexity, decreased system reliability and the loss of operator flexibility in dealing with unanticipated events.

3.

During upset transients and small breaks, the highest reactor operator priority with respect to control of water level will be to avoid overfilling the vessel and flooding the main steam lines. These events will initiate the HPCS and the control logic is capable of automatically maintaining the reactor water level within the HPCS level control range (i.e. between the high level trip elevation and the lov level system initiation setpoint).

However, it is highly desirable for the plant operators to intervene in this automatic process and assume manual reactor water level rostrol:

The key incentive is to prevent the water level frcs peaching Levei 8 since in addition to the HPCS, both the feedvater system (if operating) and the RCIC will be tripped on high level. Consequently, it is probable that for the types l

cf events described in Tables 2 and 4, the plant operators will l

intervene fairly early and assume manual HPCS control. Under normal circumstances, good operating practice will result in the system being returned to a standby condition anytime system operation is terminated. Automatic restart on low reactor water level will then occur.

t l

l I

If a p;rsistant LOCA cignal is prc0 cat, it cill est b3 possiblo to return the HPCS to a standby mode and continuous manual control will be required. Inadequate core cooling as a result of the operator failing to reinitiate the HPCS system would not occur because eventually the ADS initiation level would be reached. This would result in reactor blowdown and c' ore flooding by the low pressure ECCS. However, the availability of level

' data coupled with operator training that has stressed the central importance of adequate water level will ensure appropriate and timely operator control of the HPCS during transients and maall break accidents.

This conclusion is further reinforced when it is remembered that

- during a transient event, at least one half hour of 33Ig reactor makeup flow conditions can be permitted to exist before clad temperatures approaching 2200 F will occur.

(See Appendix B)

NOTE: The High Pressure Core Spray (HPCS) system currently restarts l

automatically if the Level 2 initiation signal reoccurs and the system is in the fully automatic mode or the system had previously been returned to standby conditions. Our evaluation of Item II.K.3.21 has considered the potential l

benefits o'f modifying the HPCS logic to extend automatic restart on Level 2 following manual termination.

(See 2.4 and 2.5) This logic is already included in the HPCI system design.

It has been concluded that such HPCS i

changes are not required by plant safety considerations. However, the changes that would provide this capability appear to be relatively straightforward and may provide additional safety margin. The recommended changes are described in Appendix A.

InoLL b REQUIRED OPERATOR POSSIBLE DELETERIOUS COULD (A) LEAD 10 15 A IT51GN CHANGE REQUIRED EVENT

. CONDITION ACTIONS OPERATORS ACTIONS (A)

DEGRADED CORE COOLING TO PROTECT AGAINST (A)

C(pgENTS

. DBA Stort tars None Operator could conceivably Yes. if sufficient.

No.

Water level maintenance Operator would have multiple fadice.

blowdown intervene and teminate systems were stopped is emphasized during operator tions that a loss of coolant phase of flow. Systems would not training and refnforced by accident had occurred. It is not accident automatically restart.

the Essergency Procedure credible that he would stop (Logic cannot be Guidelines sufficient ECC5 to cause degraded cleared because initation core cooling. Preventing manual signals are present) ovenride is not good design practice.

See Section 2.5

1. OBA Long tem Multiple

' Core cooling could be Yes. if sufficient No. It is reasonable to Redesign of the ECCS centrol logic post-LOCA actions re-Interrupted by operator systems are stopped assmas the operator wf11 to provide automatic restart of the core and qufred. See actions which violate follow procedures and certain ECC5 would require a mejerie containment Table 1 guidelines and pro-accomplish all long term comp 1tcation of control system logic.

cooling cedures. Automatic core and containment cooling This expanded logic would have to system restart would not functions sstisfactorily.

recognize and account for the occur because high Extended time periods are multiple considerations identified drywell and low water evallable. Water level does in Table 1 and Section 2.5.

(The level signals are con-not recover above 2/3 core pool cooling function. Ilmf ted stand-tinuously present and height; however up to 20 by power sources, peep NP5H. service preclude logic reset minutes is available before water requirements etc). The zero ECCS flow would cause benefits of added. protection against excessive fuel bpat-up. See operator error do not balance the Appendix B penalities of increased control system complexity (and thus fallere a

rate) and loss of operater fles-Ibflity in dealfag with unentfctpated events

9. Small HPCS has None, other Premature teswination of No. remainder of ECCS No. Low noter level is Probability of operator terufneting Break started asto-then to monitor HPCS flow. System cannot network would automatt-annuntcated and alarmed in the NPCS flow and allowing the vessel natically and the situation be returned to standby cally provide cooling.

control room; there is a con-level to reach the ADS.setpoint la is injecting especially.-

mode because LOCA signal It is probable the siderable pertad of time i e ? very low. Even if this occurs, care reactor water Present and will not operator would manually before zero makeup flew would cooling isteevee jeopdrdfred into the reactor vessel level. System Peruf t logic reset re-Initiate HPCS flow, cause fueT heat-ups operator will automatt.

RCIC is a backup training and the Emergency cally teminate Procedure Guldelines amphastre flow on high level control level and re-start at low level thittation value

2. Small Same as above Same as above As above but further Yes, but not considered a Nd. (See above)

Probability of this series of -

Break compounded by operator credible situation.

multiple operator errors.1hless then securing the low pressure Operator would continue above systems. None of the operator water level with systems can be returned HPC5 and RCIC to the full standby mode and would not restart automatically

TABLE 5

~

REQUIRED OPERATOR POSSIBLE DELETERIOUS COULD (A) LEAD TO 15 A DESIGN CHANGE REQUIRED EVENT CONDITION ACTIONS OPERATORS ACTIONS (A)

DEGRADED CORE COOLING TO PROTECT AGAINST (A)

CGONeETS Small Long tem Multipleactions; Core cooling could be Tes. if sufficient i

No.

It is reasonable to e See comments on Event 1. 304 long Break actions to required. See interrupted by operator operator error are made assume the operator will tern post-LOCA transient initiate i Table 2 actions which vloiste follow procedures and orderly shut-guidelines and procedures, accomplish a1111ong ters core down to cold Automatic system restart and containment cooling condittons would not occur because functions satisfactorily. Ex-the continuously present tended time periods are high drywell pressure available. (See Appendix B) prevents logic reset Inter.

Short tem meditte ~

blowdown phese greek of the acctdent Same discussion and conclusfons as for the D8A. No design changes required.

Inter.

Long tem mediate post accident Brask core and containe-ment cooling ups;t Short tore None other than HPCS system flow teretn-No, systen will automett-No If the plant operater takes to TraIslent responses, to monitor the sted and systes returned cally restart on low action or if he correctly Reactor water situation es-to standby mode. (Re-level teminates HpCS f*,ow, the systes level rtstng pecially water quires no inttfation ulli respond automatically to level. HPCS is signal present low reactor water signal capable of auto-i matic stopping and starting within its level control range

, Ups:t Short ters As above OEBCS system flow terutn-Adequate core cooling No. An unlikely operater Tra ntent response.

ated by simple pump will eventually require error is involved. Also RCIC Reactor water stoppege.or injection valke operator action. HPCS system would be avellable as a level rising closure. System not re-will not auto restart backup. See comment on Item 2.

turned to standby mode and ADS inttfatton will Extended time periods evallable, require manual action See Appendix 5 Ups::t Long tern Same cannents and conclustons as other a

Traxstent post incident long tem transients f.e. adequate core recovery cooling dependent upon operator action.

Situation acceptable

4.

CONCLUSIONS The current BWR ECCS control logic as well as the CS and LPCI logie modifications suggested by the NRC in NUREG-0737 Item II.K.3.21 have been reviewed. This review has included a consideration of all aspects of HPCS, LPCS and LPCI system operation which would be influenced by any expanded automatic restart capability. It is concluded that the current system design is adequate and no design changes are required. This conclusion is based on a combination of factors that include: the comprehensive nature of BWR operator training, the emphasis placed in this training on reactor water level control, the Emergency Procedure Guidelines, the relatively long time the operator has to correct errors and the extent to which low reactor water level conditions are displayed and alarmed in the control room. The most important consideration is that the benefits of providing enhanced automatic ECCS reinitiation do not justify the associated penalties of increased system complexity, reduced system reliability, restricted operator flexibility and the other undesirable effects discussed in this memorandum.

In summary, General Electric and the BWR Owners' Group believe the current BWR low pressure ECCS design,when coupled with rigorous and continuous operating staff training programs, represents.the optimum approach to BWR safety. No modification of existing LPCI and low pressure core spray l

system need to be undertaken. Modification of the HPCS system to automate restart on low level following manual trip, although not required for safety considerations, will lead to a net improvement in overall ECCS performance.

1 l

4 --. _ _ _ _ _ _ _ _ _

APPENDIX A Hizb Pressure Core Sorsy (HPCS) Systes Modifications GE and the BWR Owners' Group have reviewed the current EPCS system and have concluded that no system design changes are required. However, some additional safety margin. may be added to the BWR design by making a relatively straightforward modification to the HPCS control logic to provide automatic

- restart of the system following manual termination of pump operation. The purpose of this Appendiz is to conceptually describe this potential EPCS design change.

Summary Auto restart of HPCS after manual stop can be provided if a Icgic system can be developed which:

(1) Restarts the HPCS pump on Level 2 (2) Blocks high dryvell pressure restart, (3) Self clears if both auto signals disappear, and (4) Still allows injection valve closure or pump stop if absolutely essential for protection of the public.

Any such design should adhere to the applicable portions of IEEE 279-1971.

i e

G l

e -.

Existina loric Desian The RPCS system is initiated by either high drywell pressure or low (Level 2) reactor water level. Each parameter has four sensors and analogic trip units or four switches set up in a one-out-of-two-twice logic scheme. The above logic is assembled and the output fed to an OR gate along with the systen level manual initiation signal. The output of the OR gate is a LdCA initiation signal which is sealed in. A reset switch permits release of the seal in.

The assembled initiation signals are not sealed in so that they self-clear when the abnormal condition disappears.

Proposed Modifiestion The feature being considered will reset the auto initiation signal, on level and block the continuing auto initiation signal based on high drywell pressure. This will allow auto HPCS restart on low level af ter operator stop of the pump. It does block auto restart on high drywell pressure unless drywell pressure decreases below the setpoint and again increases above the setpoint. A decrease in drywell pressure below trip level vill remove all reset features and return HPCS logic to the original status. The HPCS pump is not stopped automatically by any reset. Pump stop still requires operator action.

System isolation must still be possible with or without this modifiction.

/

-3 0-

HPCS INITIATE CIRCUITS

[

l LOCA LOW o

HIGH MANUAL REACTOR DRYWELL INITIATE WATER

~

g PRESSURE O

LEVEL RESET m

l

\\

W e

J di l RESET l

RESET o

- RESET l

\\

l

\\

/

4 LOCA

'N 4 RESET

'7.

N (ADDITIONAL CIRCUITRY CONCEPTUAL DESIGN HPCS INITIATION CIRCUIT USING RELAY LOGIC (SOLID STATE LOGIC IS EQUALLY'ADAFTABLE)

APPENDIX B As discussed in the body of this memorandma, General Electric and the owners' Group believe the current ECCS control logic is fully adequate. This position is based on a combination of factors one of which is the period of time available bet,veen the time at which the opergtor should (but does not) start an idle ECCS system and the time at which inadequate core cooling may begin.

As discussed below this can be a fairly long time period and the purpose of l

this Appendix is to demonstrate this safety margin that is built into the BWR.

Assuming that after operator termination of a system, there is Es source of reactor water level makeup at all and further assuming the core is initially at sacuration temperature conditions, the following table summarizes the time between pump flow termination and the occurrence of 2200*F fuel clad temperatures.

Case Time to Resch 2200*F 1.

Isolated - no break Boil off from Level I 30 minutes (Typical 1y only a

~

few feet above the top of the core) 1

(

2.

Isolated - large recirculation system break Boil off from top 15 to 20 minutes of jet pump l

I.

_ ~.

la Casa 1, tha reattor watcr leval is izitially ct tha ECCS iEiticti:3 valua (Level I).

It is assumed that there is no ECCS flow and the reactor boil-off process results in decreasing reactor water level leading eventually to core uncovery. This case is representative of transients involving no reactor system break. It should be noted that Level 1 is a very low react,or level (one or two feet above the top of the active core) and the allowable period of sero reactor water make up is considerably extended if it is assuasd to start with a higher reactor water level condition.

Case 2 is representative of a large recirculation line break in a jet pump plant. For this case, it was assumed that there was no water outside the shroud and that the collapsed water level inside the shroud is at the top of the jet pump. The swollen water level is actually somewhat higher.

The heat up times given in this Appendix are minimum estimates of typical BWR values. Tite: would be longer if the events started with less than maximum expected core decay power and/or if the ECCS flow is terminated later in the transient. Availability of other makeup systems such as the control rod drive flow could significantly extend the time before core heat up would occur.

The above information clearly demonstrates that there is a significant period of time available for the operator to recognize that he has inadvertently pensitted the reactor water level to decrease and for him to take the l

necessary corrective action. _

APPENDIZ C i

Participating Utilities NUREG-0737 II.K.3.21 l

i

~

This report applies to the following plants, whose Owners participated in the report's development.

Boston Edison Pilgrim 1 Carolina Power & Light Brunswick 1 & 2 Commonwealth Edison LaSalle 1 & 2, Dresden 1-3 Quad Cities 1,2 Georgia Power Hatch I & 2 Iowa Electric Light & Power Duane Arnold Niagara Mohawk Power Nine Mile Point 1 & 2 Nebraska Public Power District Cooper Northeast Utilities Millstone 1 Northern States Power Monticello Pacific Gas & Electric Humboldt Bay 3 Philadelphia Electric Peach Bottom 2 & 3; Limerick 1 & 2 Power Authority of the State of New York Fitzpatrick Tennessee Valley Authority Browns Ferry 1-3, Hartsville 1-4, Phipps Bend 1 & 2 Detroit Edison Enrico Fetmi 2 Long Island Lighting Shoreham Mississippi Power & Light Grand Gulf 1 & 2 Pennsylvania Power & Light Susquehanna 1 & 2 Washington Public Power Supply System Hanford 2 Cleveland Electric Illuminating Perry 1 & 2 Houston Lighting & Power Allens Creek Illinois Power Clinton Station 1 & 2 Public Service of Oklahoma Black Fox 1 & 2 Vermont Yankee Nuclear Power Vermont Tankee l l

S?JPS-1 FSAR II.h.3.22 Autom_atic swatenover_or heactor Core J So16 t.101. COoillau h?/Stt-lu b11Cllon -

Verity Pr ocuourus_ana_ t L> ally _ Deslun NRC Position Tne r ee ctc core isclation cooling (hCIC) system taxes suct3on t r oat tne concensate storage tani, witn :aanual switenover to tne suppression pool wnen tne conaensate storage L&nx level is low.

This switchover snould ne maae autonatically.

Until the automat switcnover is raplemented, licensees snould verity tnat cleer anu cogent pIccecitres exist Ior the manual switenover or the RCIC systeu suct2on Irom tne condensate storage tanx to tne suppression pool.

LILCO Position The RCIC system 1s available lor mitigaticn or all transients wnere tne loss or RPCI 13 assumed.

Tne initial actuation or hCIC is automdtic and it la a helsruic Category I system witn a water source irom tne condenoate storage tanx.

Tne water suppJy Ior tne RCIC system is assurea since the lower sect)on (10 Icet) or tne concensate storag e tanx, including the connection to the 16-inch suction pip tng is Sels. 1c Category I to insure a

100,000 gallon supply or water to tne hPCI and hC1C systems.

The water available in just the lower 10 feet of the condensate storage tank is sufficient to supply RCIC for several hours, thus providing nore than adequate time for switchover of the RCIC suction using the remote manual valves available for this purpose at the appropriate time.

This switchover has been incorporated into the Station Operating Procedures.

Therefore, due to the availability of the RCIC water supply for several hours after a seismic event, automatic switchover to the suppression pool is not required.

1 I

sgr.

II.K.3.22-1

SNPS-1 FSAR II.K.3.27 Provide Common Reference Level for Vessel Level Instrumentation NRC Position Different reference points of the various reactor vessel water level instruments may cause operator confusion.

. Theref ore,

all level instruments should be referenced to the same point.

Either the bottom of the vessel or the top of the active fuel are reasonable reference points.

BWR Owners ' Group Discussion Level instrumentation, calibration, location, and scale ranges are based on the intended utilization and function of the associated instruments.

A common water level reference presently exists for all normal operating and accident conditions except the large break LOCA.

This commcn water level reference is located near the tottom of the steam

drier, which is a

functionally appropriate point for ensuring proper steam quality during normal operation.

The water level reference for a

large break LOCA is near the top of the active fuel, which is also functionally appropriate since the operator's main concern is to keep the core covered.

For a complete discussion of the Owners' Group position, refer to Attachment 1,

"BWR Owners

• Group Evaluation of NUREG-0737 II.K.3.27."

BWR Owners' Grouc Imolementation Criteria The current BWR water level indication system is f ully adequate to allow plant operators to respond properly under all postulated reactor conditions.

No design changes are, therefore, required.

LILCO Position LILCO endorses the position of the BWR Owners

• Group that no design changes are required to the current water level indication system.

For supporting documentation, refer to Attachment 1.

Note on Table 1 of Attachment 1, for Shoreham Level 2 isolates the MSIV's, not Level 1 as indicated.

II.K.3.27-1

.n

-. ~

ATTACHMENT 1 BWR OWNERS' GROUP EVALUATION OF NIREG-0737 II.K.3.27 CDMCN WATER LEVEL REFERENCE p

t TABLE & CONTENTS D_st S199tARY 1.

INTRODUCTION 1

2.

WATER LEVEL INDICATION 2

3 FIMCIIONAL DESCRIPTION 4

4.

ASSESSMENT 6

5 CON G.USIONS 6

APPENDIX A - PARTICIP ATING UTILITIES 7

9

t SIMiARY NIEEG-0737, Item II.K.3 27, " Common Idater Level Reference", requires that all reacter pressure vessel water level indicator scales be based en a concon reference zero. The intent is to reduce a perceived potential for operator confusim due to the different reference points of the various reactor vessel unter level instrur>ents.

General Electric and the BWR Owners' Group have reviewed the reactor water level instraents currently provided in a typical B'n~4 control room, and have concluded that this instrtmentaticn provides the plant operators with reac+Ar water level infomation that will permit the operators to make timely and correct decisions regarding reactor water control require =ents.

Individual utilities may adopt certain design changes in response to the NRC's request; this decisicm would be based on the individual utility's operating practices, operatcr training, and procedures. However, as discussed herein, identifica-ticn of a occcm water level reference is not vital to ensure safe reactor operaticn armi consequently, no modification of the current control roce water level instrumentaticn is required en the basis of plant safety consideraticns.

l i

l

e INTRODUCTION This memorandum has been prepared in response to NCREG-0737 Item II.E.3 27, "Cosmon Water Level Reference" for the participating utilities identified in Appendix A.

In this ites, the NRC identified a concern with the two different reference zeres of the various reactor pressure vessel water level indications. De NRC concern focussed en a potential fx operator confusier.

arising free the two different reference points for the various water level instruments.

General Electric and the BWR Owners' Group have reviewed the BW4 water level indicatim systes and believe that no modifications to the current instrtz:ent-atim are required based cr1 consideratim of plant safety. Ihis necerandu=

pmvides a detailed description of the typical BWH water level indicatien syste= and the reasoning fx the two reference zeros of this systa=.

S 6

1-

MER LEVEL, INDICATICN The BWR water level indicatim system provides the reactor operator and safety systems with infomatim regarding vessel water level. This section stammarizes the key features of the indicatim system. The discussion applies generally to all BWR/3 thmugh 6 tmits. The number of water level indicators in see of the earlier BWR designs is significantly different fmm the more recent designs, howev,er, the ftmetional description, assessment of the indication system, and conclusims are appli6able to these earlier BWR's.

As described in more detail in NEDO.-24708, " Additional Infomation Required for NRC Staff Generic Report en Boiling Water Reactors", the BWR water level instrtunentation pmvides multiple level indications displayed on the reactor control console or nearby panels in full view of the operator. These indications include (typically) three narrow range (nomal operating range) level indicators and cme narrow range level recorder, two wide range level recorders and one wide range level indicator, one fuel zone level indicator and cme fuel zone level recorder, one upset range level recorder and cne shutdom range (vessel flooding) level indicator. In addition, multiple indisting trip tmits provide wide range and narrow range reactor level safety related trip signals and related alarms. Safety, control, and infomation functicms pmvided by the level instrtanents include scram, containment isolation, ECCS initiation, RCIC initiation, permissive signals for ADS initiaticm, feedwater control, recirculation pump shutoff, MSIV closure, level readout, level recording and level alarm functions in the control room for normal, transient and post-accident conditicns.

Figum 1 depicts the correspondence of reactor vessel level and level indicator and recorder ranges.

As can be seen in the figure, reactor water level indication covers the vessel in overlapping ranges from below the bottom of the active fuel to the top of the vessel.

Them an several water levels of major importance at which automatic actions occur. These significant levels and typical corresponding acticms are described in Table 1 and are shown on Figure 1 for approxi= ate correlation.

All trip ftnctions and alarms are provided by the narrow or wide range level instrtanents. l C._ _

._A.

_1

.......-m..

I

..n

'o R*RE D*: IType;a s,1 a

1*I43 :A?! 'Tve ;Ait s

l

'(+)400 f.n<'

M180 en.

l Smu'DOmhaangt

=

f A

I W'P5t*

anammouwmAnct tr8DE mAnst i

• 00 en.

pu p _ _ _,_ _ _es_;.

Level 8 _._,

1

8. _

.1

,a 1

. ? _..*._,. __ _. -_._ __

i Lev el 7 -

g_ _

a'

• E ' *

• l see ecs

,c.,

n

=

Lev el 4 - _.

Level 3 --

N i

.e- -

-o ms,muun8 sne:

a Level 2 --

Smut "C'c *C5 j

_ e..

_y^"

Level 1 _ _

.o.

p._ _,o, o, Aey,v, e

e___.

FUE L 23N E Hs5TRuwENT 1

f ZERC TAS I

r..nI'2= Pf_asm.t.t.un en.L _.

-.!-'15'r _

i FIGURE 1 TYPICAL 8WR WATER LEVEL INDICATORS ON REACTOR CONTROL PANELS

--,-e-.-,

e,----www,-,,-

.r--.,,,.w-,.,,,,- - - --o,

---ve,-4,--

e4

l j

Table 1 j

SUMMARY

OF SIGNIFICANT REACTOR VESSEL LEVELS

.1pproximate Elevation Above Level Action JAF (ft)

_ Level 8 Mai6 Turbine Stop Valve. Clostre, HPCI/HPCS 18-1/2 Injection TermLnated, Trip RCIC Turbine, Trip Reactor Feedwater Pumps and Condensate Booster Pumps, Scram (rtm mode only)

Level 7 Alarm 17 Operating Reactor Le vel is Maintained Below a

the High Level Alarm and Above Low Level Alarm.

Level 4 Alarm, Run Back Recirculation Flow on Loss of 16 One Feed Pump.

Level 3 Scram and Rtm Back Recirculation Flow, 14-1/2 Permissive for ADS, Close RHR Shutdown Isolation Valves.

Level 2 Initiate Reactor Core Isolaticr2 Cooling System, 11 Division 3 Diesel Generator and High Pressure l

Core Spray System, Close Isolation Valves, Except RHR Shutdown Isolation Valves and MSI/'s, Shutdown Recirculatim System.

Level 1 Initlate Residual Heat Removal Pumps and LPCS, 1-1/2 Start Divisim 1 and 2 Diesel Generators, Close MISV's and Initiate ADS (in conjunction with other signals.)

Top of Active Fuel 0

Bottom of Active Fuel Fuel Zone Indication 1/2 - : :.L

f FUNCTIONAL DESCRIPTION All instrumentatim, except the fuel zone instrtments have a comem reference sero.

111 instrtmentatim, except the shutdown and fuel zone instruments, are calib-rated based on nomal power operating pressure and temperature conditions.

The shutdown and fuel zone instruents are calibrated based m depresstrized reacter conditions consistent vith their ftmetions.

The BWR water level indicatim scheme is based cc two reference levels:

one cicae to the bottom of the &yer skirt' for nomal operation, upset and shutdown events, and one cicae to the top 't the active fuel'.

Four of the five instrtment ranges (narrow, wide, upcet, and shutdown ranges) have indicator and recorder sales which share the bottom of the dryer skirt as a comen reference zero. Only the fuel zone instrtment's scales are based on zero located at the top of the active fuel.

The narrow range instrtmentaticn is pmvided to monitor and control reactor "

water level during normal power operating conditicms. The reference point to the bottom of the dryer skirt is selected based on nomal plant operation censideraticms. Specifically, high water lev'el decreases the gality of stea=

delivered from the reactor due to degraded separator perfomance. Low water level that would permit passage of wet steam fmm the reactor due to inadequate skirt subnergence muld likewise potentially damage the main turbine and feedwater turbine. Hence a reference locaticn relative to the bottom of the &yer skirt is appropriate. In addition to controlling water level during plant operaticn, the narrow range instrtmentation also provides i

high and low water scram signals and ADS low level signals.

The wide range instruments are pmvided are provided as an extensicn of the narrow range to cover abnomal operating transients. The wide range scale encompasses the setpoints for initiatim of HPCI/RCIC and low ;ressure ECCS and pmvides initiation signals for ADS and isolation systems. Thes e instruments are calibrated for nomal power operating pressure and temperature conditions to assure pmper initiation of safety frunctions and to avoid

(

'Throughout this memorandum, " bottom of the dryer skirt" refers to a locaticn near the bottom of the &yer skirt. Similarily, " top of the active fuel" l

refes to an elevatien at or somewhat above the top of the active fuel. 1

(. - - - - -

.. -. ~

[

inadvertcnt ocram or innreased spuricus signalc that would jeopardize n: mal plant cper tions and result in reactor mnvailtbility. For consistenay, their sero reference is the same as that for narrow range instrtments.

The upset range instrumentaticn is an upward extension of the normal range.

It is provided to acnitor smusually high water level transients that can be postulated to occur during reactor operaticn. Its reference sero is the same as the narrow-range instrumentation.

The shutdown range is used for acnitoring the reactor water level smder shutdom conditions when the reactor is depressurized and flooded, prior to vessel head removal. For consistency, its reference zero is the same as the narrow range instrtmentation.

Fuel zone level instrtmentaticn is provided to indicate reactor water level following a large break LOCA (such as a double ended recirculation line break) and to verify core reficod by ECCS.

It is not intended to give meaningful indication under any other plant transient or operating conditions or when the reactor is pressurized. Since the only ftmeticn of the fuel zone instrtment-aticn is to acnitor level after a large loss of coolant accident, its zero reference locaticn is selected as the top of the active fuel.

As indicated by the above discussion, the level instrtmentation, calibration, locaticm and scale ranges are based cn the intended utilization and function of the instrtments. It is evident, then, that there already exists an overall connan water level reference for all normal operating and accident conditicns except the large break LOCA, and that the water level zero reference for the large break LOCA differs from th' others for a good reason.

i l

This different reference level for the fuel zone level instrtmentation is not confusing to the operator because he is familiar with the difference as a result of training and experience. The operator's awareness of the difference is constantly reinforced during routine control room surveillance since the fuel zone level is always off scale high and is adjacent to the wide range level instrtments which are cn scale.

l Since the instrtments, the calibraticm, and ranges are based cm specific, well defined and logical functional criteria, operator confusion should not occur...

ASSESSENT To respond to the NRC's concern regarding a cosmaan water level reference, G:neral Electric and the BWR Owners Group have reviewed the BWR water level

- indicaticri system, giving attention to the following consideraticris:

Responsivene'ss to the NRC's requirement Impact cri safe reactor operation Compatibility with htanan' factors concepts The BWR wacer level instrumentaticri is based cri an overall commen reference z:ro for all nomal operation, transient and accident conditions except the large break LOCA.

Thin design is based cri the philoso#2y that the bottom of the dryer skirt is the cost significant vessel elevation for nomal, upset, and most postulated cecident conditicris. For the case of abnormal, diminishing water level, the trip functions autmatically initiate emergency core coolant injection l

cystcms. With the redundancy of emergency systems available the reactor water l

leval will generally not decrease to the top of the fuel for a large spectrum of accidents and transients. Further, the reactor operator's primary concern when in any decreasing low water level conditicL1 is to act so as to raise the l

water level. Any quantitative knowledge of the water level is much less significant than the fur 4damental and paramount task of restoring water level to near nomal.

The fuel zone instrument, with its reference point (zero) at the top of the cetive fuel, becomes important for large design basis LOCAs as the primary verificaticr1 of level. It provides secondary verificaticr1 of level for small break LOCAs that ECCS has perfomed effectively. Correlation of this instrument with the bottom of the dryer skirt is not rweessary.

CCNCLUSICN General Electric and the Bh"it Owners' Group have concluded that the current BWR water level indication system is fully adequate to allow plant operators to respcrid properly trider all postulated reactor conditicris, and that there are no required design changes based cut any plant safety consideraticns.

l Individual utilities may adopt certain design changes in response to the NRC l

request, this decisicas would be based en the individual utility's operating practices, operator training and precedures.

4-

SNPS-1 FSAR II.K.3.28 Study and Verify Oualitication of Accumulators on ADS Valves NRC Position Safety analysis reports claim that air or nitrogen accumulators tor the ADS valves are provided with suf ficient capacity to cycle i

the valves open five times at design pressures.

GE has also stated the ECC systems are designed to withstand a

hostile environment and still perform their function 100 days after an accident.

The Licensee should verify that the accumulators on the ADS valves meet these requirements, even considering normal leakage.

If this cannot be demonstrated, the Licensee must show that the accumulator design is still acceptable.

The ADS

valves, accumulators, and associated equipment and instrumentation must be capable of performing their functions during and following exposure to hostile environments and taking equi xnent or instrumentation.

no credit for non-safety related E

Additionally, air (or nitrogen) leakage through valves must be accounted for in order to assure that enough inventory of compressed air is available to cycle the ADS valves.

LILCO Position There are four modes of supplying air to the SRV's (normal operation, short term supply, intermediate term supply, and long term supply).

During normal operation, air is supplied to the short term and intermediate term accumulators.

Air is retained in these accumulators by check valves so they remain pressurized during this mode.

In the event of an abnormal condition and before valve changeover is completed, the short term accumulators on each SRV will supply air sufficient for at least rive actuations of each SRV.

Each accumulator also has sufficient pressure (>25 psig) to maintain the valve open after five actuations.

The valve changeover from short to intermediate term mode occurs within minutes, so that eftects of valve operator leakage, during the short term mode, are minimal.

For the intermediate term supply moce, in addition to any air remaining in the short term accumulators, the two intermediate term accumulators are each capable of supplying air sufficient for at least 55 additional SRV actuations for a

minimum of 48

hours, including the maximum allowable leakage trom all eleven SRV operators.

These accumulators are sized by extencing the snort term accumulator sizes and compensating for total SRV operator leakage over 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> from vendor furnisned maximum leakage rates.

II.K.3.28-1 I

_ _. _ _ -,. ~,. _,,. - _ _, -

1 SNPS-1 FSAR The accumulator and connected piping are designed to ASME III Class 2 requirements and contain no active compeaents other than the in-line check valves which may perform an isolation function and a Class 1E powered motor operated valve w"ich provides intermediate and long-term ADS supply air.

The stainless steel construction of the accumulators and piping is not subject to railure during hostile environmental conditions.

Valve leakage has been accounted for and is not or concern during long-term conditions.

Beyond 148 hours0.00171 days <br />0.0411 hours <br />2.44709e-4 weeks <br />5.6314e-5 months <br /> the long term mode uses an air connection outside of the reactor building for replenishing the air supply.

This air connection and connecting piping is also designed to ASME III Class 2 requirements.

A portable compressor, or alr/ nitrogen bottles may be connected to the system to sustain SRV operability indefinitely.

l l

l l

l II.K.3.28-2 l

SNPS-1 FSAR II.K.3.44 Evaluation of Anticipated Transients with Single Failure to Verify No Fuel Failure NRC Position For anticipated transients combined with the worst single failure and assuming proper operator

actions, licensees should demonstrate that the core remains covered or provide analysis to show that no significant fuel damage results fron core uncovery.

Transients which result in a stuck-open reliei valve should be included in this category.

BWR Owners' Group Discussion l

Analyses have been performed for the worst anticipated transient of those identified in R.G. 1.70 (loss of feedwater event) with the vorst single active f ailure (loss of HPCI) which demonstrate that the reactor core remains covered with water until stable conditions are achieved.

Analyses have also been performed for further degraded conditions involving a stuck-open relief valve in addition to the worst transient and single failure.

The results of these analyses show that, with proper operator action, the core remains covered.

For a

complete discussion of the Owners ' Group response, refer to Attachment 1, "BWR Owners' Group Evaluation of NUREG-0737 Item II.K.3.44."

BWR Owners' Group Implementation Criteria No implementation criteria are applicable for this item.

LILCO Position LILCO endorses the result of analyses described in Attachment 1 demonstrating that the core remains covered for the worst anticipated transient (loss of feedwater) with the worst single active failure (loss of HPCI).

LILCO also endorses the results of additional analyses demonstrating the capability to keep the core covered for the conditions described above in combination I

with a

stuck-open relief valve.

For supporting documentation, refer to Attachment 1.

i II.K.3.44-1 1

-,-,,e_...

..,y-

ATTACHMENT 1 BWR OWNERS' GROUP EVALUATION OF NUREG-0737 ITEM II.K.3.44 ADEQUATE CORE COOLING FOR TRANSIENTS WITH A SINGLE FAILURE

Table of Contents Pag Summary I.

Introduction 1

II.

Criteria, Scope and Assumptions 2

i III. Discussion 3

IV.

Conclusion 10 V.

References 11 Appendix A - Participating' Utilities 12

Summary Analyses of the worst anticipated transient (loss of feedwater event) with the worst single failure (loss of a high pressure inventory makeup or hea,t removal system) were performed to demonstrate adequate core cooling capability.

It is shown that, for the BWR/2 through BWR/6 plants, adequate core cooling is maintained for these wrst-case condi-tions. Analyses of further degraded conditions involt ing a stuck-open relief valve in addition to the worst transient and single failure were also performed. The results show that, with'prope? operator action, the core remains covered and therefore adequate core cooling is achieved.

1

ADEQUATE CORE COOLING FOR TRANSIENTS WITH A SINGLE FAILURE I.

Introduction This report has been prepared as the BWR Owners' Group generic response to NUREG-0737 Task Item II.K.3.44 which addresses the issue of adequate core cooling for transients with a single failure for those plants identified in Appendix A.

The text of Item II.K.3.44 is as follows:

"For anticipated transients combined with the worst single failure and assuming proper operator actions, licensees should demonstrate that the core remains covered or provide analysis to show that no significant fuel damage results from core uncovery.

Transients which result in a stuck-open relief valve should be included in this category."

At the outset it should be noted that the conditions described in II.K.3.44 (i.e., transients plus single failures) go beyond the current BWR design basis and that the item's reference to transients with multiple failures goes beyond the regulatory requirements as I

specified in Regulatory Gui~de 1.70, Rev. 3.

The multiple failures specified involve consideration of a stuck-open relief valve (SORV) combined with the worst single failire.

GE and the Owners Group t

continues to support the current BWR design basis approach.

This report is intended to provide information to address Item II.K.3.44, but it does not reflect our intention to change the current BWR design basis approach.

It is shown that, for the GE BWR/2 through BWR/6 plants, the core remains covered for any transient with the worst single failure.

This is achieved without any operator action to manually initiate emergency core cooling system (ECCS) or other inventory makeup systems.

The worst transient with the worst single failure is shown to be the loss of feedwater (LOF) event with a failure of l.

the high pressure ECCS or one isolation condenser (IC) loop, whichever is applicable.

For the bounding LOF event, studies which included even more degraded conditions have been documented in Reference 1.

The degraded c'onditions cover the, failure of HPCS (or HPCI or FWCI or IC) and one 50RV.

Reference 1 shows that the core will remain covered and therefore, that no fuel failure would occur.

II.

Criteria, Scope and Assumptions NUREG-0737 Item II.K.3.44 requires that the licensees demonstrate adequate core cooling to prevent the fuel from incurring significant damage for the anticipated transients combined with the worst single failure.

In order to meet this requirement, either one of the following two criteria should be satisfied:

1.

The reactor core remains covered with water until stable conditions are achieved; or 2.

No significant fuel damage results from core uncovery.

For BWR plants, this report will show that Criterion 1 is set.

The report makes the following assumptions:

a.

A representative plant of each BWR product line, BWR/2 through BWR/6, is used to represent all of the plants of that product line.

l b.

The anticipated transients as identified in NRC Regulatory Guide 1.70, Revision 3 were considered.

c.

The single failure is interpreted as an active failure.

d.

All plant systems and components are assumed to function l

normally, unless identified as being failed.

2-

I III. Discussion Table 1 lists all of the transie9ts which were considered in this study.

The event sequence of each transient was examined for each product line to determine the impact on core cooling.

The following three factors were used to determine the worst transient and the worst single failure:

a.

Reduction or loss of main feedwater or coolant makeup or heat removal systems, especially high pressure systems, e.g., HPCI, FWCI, HPCS, RCIC or IC.

b.

Steam release paths causing rapid reactor coolant inventory loss, e.g., S/RV's, turbine, or turbine bypass valves.

c.

Power level, especially the timing of scram.

Based on these considerations, a comparison was made among the transients in Table 1.

l l

l

1 TABLE 1 SlMtARY OF INITIATING TRANSIENTS

(

Reference:

NRC Regulatory Guide 1.70, Revision 3) 1.

Loss of Feedwater Heating 2.

Feedwater Controller Failure - Maximum Demand 7

Pressure Regulator Failure - Open 4.

Inadvertent Safety / Relief Valve Opening 5.

Inadvertent Residual Heat Removal (RHR) Shutdown Cooling Operation 6.

Pressure Regulator Failure - Closed 7.

Generator Load Rejection 8.

Turbine Trip 9.

Main Steam Isolation Valve (MSIV) Closure 10.

Loss, of Condenser Vacuum 11.

Loss of Normal AC Power 12.

Loss of Feedwater Flow 13.

Failure of RHR Shutdown Cooling 14.

Recirculation Pump Trip 15.

ilecirculation Flow Control Failure - Decreasing Flow 16.

Rod Withdrawal Error

17. Abnormal Startup of Idle Recirculation Pump 18.

Recirculation Flow Control Failure - Increasing Flow 19.

Fuel Loading Error 20.

Inadvertent Startup of High Pressure Core Spray (HPCS) or High PressureCoolantInjection(HPCI)orFeedwaterCoolantInjection (FWCI) or Isolation Condenser (IC), whichever is applicable..

In Reference 2, the events of Table 1 are compared in detail for a typical BWR/4 plant.

In particular the impact on core cooling for each transient is evaluated by comparison to the analysis results for the LOF event in the section titled " Applicability of Analyses."

It is found that the LOF event is the most severe transient from thecorecoolingvie@ointduetoitsrapiddepletionofreactor coolant inventory. This conclusion has generic applicability to l

all BWR product lines covered by this study.

The same approach was also used to select the single failures which would pose the greatest challenge to core cooling. Among all of the possible failures considered (Table 2), the following failures are identified as the most important ones:

l 1.

Failure of HPCI or HPCS or FWCI or one IC loop, whichever is applicable.

2.

Failure of RCIC.

3.

One of the S/RV's, which has opened as a result of the transient, fails to close.

Items 1 and 2 are the poss'ible limiting failures because they represent loss of high pressure inventory makeup or heat removal systems which would be relied on following a loss of feedwater l

event.

Item 3 is a possible limiting failure, because it results in the largest steam release rate from the vessel compared to other possible release paths (e.g., a stuck-open turbine bypass valve).

No other failures identified in Table 2 result in a direct challenge to core cooling capability.

l _ --,_. _

TABLE 2 LIST OF SINGLE FAILURES WHICH CAN POTENTIALLY DEGRADE THE COURSE OF A BWR TRANSIENT 1.

One or all of the bypass valves fail to modulate open when required.

2.

One of the bypass valves, which has opened as a result of the transient, fails to close.

3.

Failure to trio the turbine or feedwater pumps on high water level.

4.

One main steam isolation valve (MSIV) fails to close when regtired.

5.

One of the safety / relief valves fails to open when required.

6.

One of the safety / relief valves, which has opened as a result of the transient, fails to close.

7.

Failure to trip one recirculation pump.

8.

Failure to run back the recirculation pumps.

l 9.

Failureofhighpressurecoolantinjection(HPCI)orhighpressure core spray (HPCS) or feedwater coolant injection (FWCI) or one isolation c,ondenser (IC) loop, whichever is applicable.

I 10.

Failure of reactor core isolation cooling RCIC) or one IC loop, whichever is applicable.

11.

Failure of one low pressure coolant injection (LPCI) loop or the low pressure core spray (LPCS) system.

1

. I.

TABLE 2 (CONT'D) 12.

Loss of one residual heat removal (RHR) system heat exchanger.

13.

A, single control rod stuck while the remainder of the control rods are moving.

14.

Failure to achieve the rod block function (i.e., a single control rod will withdraw upon erroneous withdrawal demand).

15.

Loss of one diesel generator if loss of AC power was the initiating event.

O.

0 Secause of the relatively low steam loss capacity through one SORV (Failure 3, Page 5) compared to the sakeup water capacity of the highest capacity makeup water system, the failure of the highest capacity high pressure makeup system (Failure 1, Page 5) would be worse than a stuck open relief valve (Failure 3 Page 5).

For example, for a typical BWR/4, representative values of HPCI makeup and S/RV flow are 18% and 6% of rated feedwater flow, respectively.

Because of the higher makeup rate of HPCI/HPCS relative to RCIC (3%

of rated feedwater flow), Failure 1 would be worse than Failure 2.

Table 3 lists the worst combination of transient and single failure for the GE BWR product lines covered by this study.

Even with the worst single failure in combination with the LOF I

event, the RCIC or at least one IC loop will function to provide makeup and/or to remove decay heat while the vessel pressure remains high. The design basis for the RCIC or the IC is such that they are capable of removing decay heat with the vessel being isolated.

Analyses of the LOF event with the worst single failure have been performed to support this conclusion.

For example, for BWR/2 plants, such analyses are documented in Reference 1 Table 3.2.1.1.5-5.

These analyses show that the isolation condenser heat removal capacity is greater than the decay heat generation rate and will lead to a safe and stable condition. Similar analyses have been performed for representative plants with the RCIC system. These analyses show that for the worst transient wit'n the worst single failure, the minimum water level for different BWR product lines ranges from 6 ft to 11 ft above the top of the active fuel.

With even more degraded conditions, i.e., one SORV in addition to the worst case transient with the worst single failure, reference plant analyses in Reference 1 Tables 3.2.1.1.5-9 and 3.2.1.1.5-10 show that 'or the plants analyzed the RCIC system can automatically provide sufficient inventory to keep the core covered even with a single failure plus a SORV.

This capability is not a design basis for the RCIC system, and not all plants have been analyzed to demonstrate this capability.

If a plant should not have this.

3 TABLE 3 THE t~.r;>f CASE OF TRANSIENT WITH A SINGLE FAILURE FOR DTFFERENT BWR PRODUCT LINES Product Line Transient with a Single Failure (The Worst Case)

BWR/2 LOF + Failure of one IC Loop (Oyster Creek only)

LOF + Failure sf FWCI (Nine Mile Point only)

BWR/3 LOF + Faifure of FWCI (Millstone only)

LOF + Failure of HPCI (others)

BWR/4 LOF + Failure of HPCI BWR/5 LOF + Failure of HPCS BWR/6 LOF + Failure of HPCS l..

. -- -_.. -~ - - - -.

capability, manual depressurization will avoid core uncovery for the case of LDF plus worst single failure plus 50RV.

It should be noted that manual depressurization is the proper operator action for all plants during loss of inventory conditions when the high pressure cooling systec(s),are unable to restore and maintain RPV level.

These proper operator actions are allowed for in the NUREG-0737 requirement.

For plants without RCIC, manual depressurization will avoid core uncovery for the case of LOF plus worst single failure plus 50RV.

IV.

Conclusion The anticipated transients in NRC Regulatory Guide 1.70, Revision 3 were reviewed for all BWR product lines BWR/2 through BWR/6 from a core cooling viewpoint.

The LOF event was identified to be the most limiting transient which would challenge core cooling.

The BWR is designed so that the high pressure sakeup or inventory maintenance systems or heat removal systems (HPCI, HPCS, FWCI, RCIC or IC) are independently capable of maintaining the water level above the top of the active fuel given a loss of feedwater. The detailed analyses show that even with the worst single failure in combination with the LOF event, the core remains covered.

Furthermore, even with more degraded conditions involving one 50RV in addition to the worst transient with the worst single failure, studies show that the core remains covered during the whole course of the transient either due to RCIC operation or due to manual depressurization.

It is concluded that for anticipated transients combined with the j

' worst single failure the core remains covered.

Additionally, it is concluded that for severely degraded transients beyond the desigr l

l 1o.

basis where it is assumed that a S/RV sticks open and an additional failure occurs the core remains covered with proper operator action.

V.

References II.

Section 3.2.1 (prepublication form) of " Additional Information Required for NRC Staff Generic Report on Boiling Water Reactors,"

NEDO-24708, March 31, 1980 2.

Section 3.2.2 (prepublication form) of " Additional Information Required for NRC Staff Generic Report on Boiling Water Reactors,"

NED0-24708, June 30, 1980 3.

Section 3.5.2.1 (prepublication form) of " Additional Information Required for NRC Staff Generic Report on Boiling Water Reactors,"

NED0-24708, August 31, 1979 l

l o

l l

1 11 -

APPENDIX A PARTICIPATING UTILITIES NUREG-0737, II.K.3.44 l

This report applies to the following plants, whose owners participated in the report's development.

Boston Edison Pilgrim 1 Carolina Power & Light Brunswick 1 & 2 Commonwealth Edison LaSalle 1 & 2, Dresden 1-3, Quad Cities 1 & 2 Hatch 1 & 2' Georgia Power j

Iowa Electric Light & Power Duane Arnold Jersey Central Power & Light Oyster Creek 1 Niagara Mohawk Power Nine Mile Point 1 & 2 Nebraska Public Power District Cooper Northeast Utilities Millstone 1 Philadelphia Electric Peach Bottom 2 & 3; Limerick 1 & 2 Power Authority of the State of New York Fitzpatrick Tennessee Valley Authority Browns Ferry 1-3; Hartsville 1-4, Phipps Bend 1 & 2 Vermont Yankee Nuclear Power Vermont Yankee Detroit Edison Enrico Fermi 2 Mississippi Power & Light Grand Gulf 1 & 2 Pennsylvania Power & Light Susquehanna 1 & 2 i

l Washington Public Power Hanford 2 l

Supply System Cleveland Electric Illuminating Perry 1 & 2 Houston Lighting & Power Allens Creek Illinois Power Clinton Station 1 & 2 Public Service of Oklahoma Black Fox 1 & 2 Long Island Lighting Shoreham Northern States Power Monticello 12

sNPS-1 FSAR II.K.3.45 Evaluaticn or Depressurization hitn Otner Tnan Full ads hxe Position Analyses to support cepressurization modes otner tnan rull actuation or tne ADS (e.g., early blowoown witn one or two SRVs) shoula te provided.

Slower depressurization woula reauce tne possio111ty or exceecing vessel integrity limits ny rapid Coolaown.

nWx Owners

• Group Discussion It nas been celtonstraten' that a rull ADb nlowdown coes not cause the stress 11mits ror vessel integrity to ne exceeoed.

In

acalcion, reducea depressurization rates ao not signiricantly decrease ratigue usage or the reactor vessel and core support structure.

On tne contrary, reducea depressurization rates can nave an aaverse ettect on core cooling capab111ty ny 411owing the core to become uncovered tor longer perloos or time.

For a complete alscussion or the Owners

• Group

position, reIer to Attacnment 1, "ohk owners

• Group Evaluation or hunt.G-0737 Item II.K.3.45."

nWh owners

• Group Implementation Criteria Since a rull ads olowdown is well within the design basis or the reactor pressure vessel and ADS is properly designed to minimize tne ena11enge to core cooling, no change in cepressurization rate is required.

LILCu Position LILCO endorses the position or the bhR Owners' Group tnat reduced cepressurization rates are not necessary from tne stanapoint of sdIety to ensure reactor vessel Integrity.

For supporting cocumentation, rerer to Attachment 1.

I II.K.3.45-1

ATTACICfENT 1

\\

e i

BWR OWNERS' GROUP EVALUATION OF l

NUREG-0137 ITEM II.E.3.45 ALTERNATE HODES OF DEPRESSURIZATION

4.

~.--

2 4

e I

TABLE OF CONTENTS StD0ERY I

INTRODUCTION 1

II ASSUMPTIONS 3

i I

III RESULTS 3

l 1

i IV DISCUSSIONS V

CONCLUSIONS 7

APPENDIX A 13

-i-

SUMMARY

Analyses of depressurisation racea other than full ADS were performed ~to determine the effect on reactor vessel integrity and core cooling capability.

It is shown that:

1.

Vessel integrity limits are not exceeded for full ADS blowdown, 2.

For slower depressurisation rates, there is little benefit on vessel fatigue usage relative to full ADS blowdown, and 3.

Slover depressurisation rates can have an adverse impact on core cooling capability.

i t

I l

l 4 - _ - -.

I.

Introduction The feasibility study reported herein addresses NUEEG-0737 item II.E.3.45 which states,

" Analyses to support depressurization modes other than full actuation of the ADS (e.g.,

early blowdown.with one or two SRV's) should be provided. Slower depressurization would reduce the possibility of exceeding vessel integrity 1Leits by rapid cooldown".

An evaluation of alternate modes of depressurization other than full actuation of the Automatic Depressurization System (ADS) is made for the plants listed in Appendix A with regard to the effect of such reduced depressurization rates on core cooling and vessel integrity.

Depressurization by full ADS actuation constitutes a depressurization from about 1050 psig to 180 psig in approximately 3.3 minutes. Such an event, which is not expected to occur more than once in the lifetime of the plant, is well within the design basis of the reactor pressure vessel. This conclusion is based on the analysis of seve.ral transients requiring depressurization via the ADS valves. Results of these analyses indicate that the total vessel fatigue usage is less than 1.0.

Therefore, no change in the depressurization rate is necessary. However, to comply with the above request reduced depressurization rates were analyzed and compared with the full ADS actuation. The alternate modes considered cause vessel pressure to traverse the sene pressure range in 1) depressurization case 1 (ranges from 6-10 minutes depending on plant size and ADS capacity) and 2) depressurization case 2 (ranges from 15-20 minutes). The case 2 depressurization bounds the possible increase in depressurization time by producing an undesirably long core uncovered time. The case 1 depressurization gives the results of an intermediate depressurization. These modes are achieved by opening a reduced number of relief valves. These blowdown rates are illustrated by Figure 1.

l 1 I

o 0

1

=

G 1

~

__2 1

x S - -

I N.

S Y

N L

O A

I

)

N T)

A A2N s

Z( I N

I M

N I

RE US0 s

D SA2 E

SC -

S E

5 U

R 1

N 1

P

(

S E

E E

D

- 8 R

T U

A

)

G R

I 1

C

/

~

/___1 l

I' N

._E W

O N

O O

S W

N.

I s.

O T

)

(

L A

Z)N N

B I1 I s

R( M L

U E

SE0 s

S SS1 S

N EA N

E RC6 E

V P

(

E

\\

M s

D \\

I

\\

i s

\\

T l

s

\\

0 i

\\

\\

\\

t s

\\

L N

\\

\\ \\

L_

V

)

d SN DI

\\ \\

AM I

\\

\\

L3 1

s\\

m(3

\\

i Y

1

~

O i

8 0

2 '0 l

0 0

1 1=

dEm (i{cL l

D )g I~n1_"

lI

(

(

• <(

k 4;

ii

s II. Assumptions j

The major assumptions used for the core cooling analysis are:

1.

No high pressure cooling systems are available.

2.

All low pressure gCC systems are available.

l 3.

Assumptions as sta,ted in NEDO-24708, Sect. 3.1.1.3,

" Justification of Analysis Methods"; which includes the use of 1978 ANS Decay Best (mean value).

t l

l III. Results i

A.

Vessel Integrity The depressurisation events considered are full ADS blowdown and blowdown over 10 and 20 minute intervals. The reactor vessel stresses for these events are within the acceptance stress limits defined by ASME Code Section III for emergency conditions (Level C). The core support structures and other safety related internal components are also within applicable emergency condition stress ILaits.

The ADS operating conditions which affect fatigue usage of vessel or core support structures are not significantly different for fast and slow blowdown events. Specific calculations of fatigue usage are not r2 quired for emergency conditions (Level C). However, available pressure vessel fatigue analyses show the usage per event to be < 0.1 per full ADS event.

In summary, reactor vessel and core support structure integrity is assured for the blowdown rates considered if an ADS event should occur, and reduced rates of depressurization do not significantly decrease fatigue usage.

l.

.--y.

.. ~ -, _ _ -.

---._-y.

,_._._m

--,-,.y-r-,-.___.,

3.

Core Coolina Capability i.

Examination of the reduced depressurisation rates under consideration with respect to core cooling concerns shows that, 1.

Yessel depressurization for a case 2 blowdown (15-20 minutes)

, causes the core to be uncovered for a lengthy period of time even assuming syst.en initiation at the earliest reasonable time.

2.

Yessel depressurization for a case 1 blowdown (6-10 minutes),

when actuated at the same level as the full ADS case, will result in less vessel inventory at the time of ECCS injection and can result in longer periods of core uncovery.

3.

Vessel depressurization for a case 1 blowdown (6-10 minutes) when actuated considerably earlier than at the ADS initia' tion setpoint can result in some improvement in core cooling.

However, the operator is required to act more quickly in these cases (i.e., within 1-6 minutes after the accident). This l

earlier depressurization also reduces the time available to start high pressure system injection and hence to avoid the need for manual depressurization.

It also increases the frequency of depressurization.

The results of the calculations are presented in Tables 1 through 4.

They show the total core uncovered time and remaining vessel inventory at the time of low pressure ECCS injection. A discussion of these results followe in Section IV.

1 l

l _.

IV.

Discussion The results are based upon calculations performed with the assumptions stated earlier using a representative BWE/3 and a BWE/6 to show consistency of results across the product lines. The transients considered are an outside steamline break and a stuck-open relief valve. The ADS will depressurize the vessel to the, low pressure ECCS injection setpoint when no high pressure cooling systems are available. The depressurizations used are initiated at different times based on the downconer water level. The first initiation time considered is when the water level is at the top of the active fuel which is consistent with the original design for most plants and thus is the basis for comparison. The second initiation time considered is the downconer water level of 34 feet from the bottom of the vessel which still provides the operator with a reasonable tLue to attempt to start the high pressure systems. The last initiation time considered is the high pressure make-up system setpoint (Level 2 for BWE/6 and Level 1 for BWE/3) plus 60 seconds which is the earliest time in which depressurization could be expected to occur.

The core cooling criteria used in assessing the impact of a reduced depressurization rate are:

1.

Inventory in the core and lower plenum at the time of low pressure ECCS injection as predicted by the SAFE model.

2.

The total time which the top of the active fuel (IA7)

I remains uncovered as predicted by the SAFE model.

The first criterion demonstrates the increased mass loss due to boiloff for the longer blowdown, since mass loss due to flashing will be independent of the depressurization rate providing the boundary pressure values are the same for all the rates. The second criterion is a measure of the resultant core temperature.

i 1

1 Ref. 1 NEDO-24708 " Additional information required for NRC Staff Generic Report on Boiling Water Reactors", August,1979.

l l 1

Table 1 gives the results for a BWR/6 assuming an outside steamline break.

As the length of de' pressurization is increased the vessel inventory at the time of gCCS injection decreases and the total core uncovered time increases.

Table 1 further shows that for actuation times based on higher water levels (i.e., 34' and Level 2 + 60 seconds) longer depressurizations exhibit the same trends. Furthermore, for any particular depressurization rate, raising the actuation letal increases the vessel inventory at ECCS injection and decreases i

the total core uncovered time. However, this also decreases the time the operator has available to try to get high pressure level control systems l

working in order to avoid the need to depressurize.

Table 2 shows that these same results are exhibited for the case of a stuck open relief valve. Table 3 shows the results for a BWR/3 assuming an outside steamline break. Examination of the table shows the same trends as l

l Table 1, and therefore the results are applicable to all product lines. Table l

4 shows that these general trends are independent of the models used by exhibiting the same trends for a BWR/3 using standard Appendix K licensing assumptions.

e 0

e

..s.

!'I ii 6

V.

Conclusion

. 4 The cases considered show that no appreciable improvement can be gained by a slower depressurization based on core cooling considerations. A significantly slower depressurization rate will result in increased core uncovered time. A moderate decrease in the depressurization rate necessitates an earlier actuation time resulting in less time available for operator action to start high pressure 3CCS without significant benefit to vessel. fatigue This will also result in an increased frequency of ADS actuation.

assge.

Finally, it is of paramount importsace to note that the ADS is not a normal core cooling system; it is a backup for high pressure cooling systems (feedwater, RCIC, RPCI/S). If ADS operation is ever required in a BWR, it will be because core cooling is threatened. Since a full ADS blowdown is well within the design basis of the reactor pressure vessel and ADS is properly designed to minimize the threat to core cooling, no change in the depressurization rate is necessary.

l. - -

[

l TABLE 1 RESULTS FOR BWR/6 0UTSIDE STEAMLINE BREAK i

NO HIGH PRESSURE SYSTEMS AVAILABLE l

l LIQUID INVENTORY IN DEPRESSURIZATION CORE CORE AND LOWER PLENUM DEPRESSURIZATION INITIATION UNCOVERED AT LOW ?RESSURE ECCS CASE LEVEL TIME (SEC)

TINE (SEC)

INJECTION (LBS)

J FULL ADS TAF*

1086 26 1.603 x 10s CASE 1 TAF 1086 117 1.528 x 105 CASE 1 34' 610.6 10 1.779 x 105

$=

FULL ADS Level 2t 78.3 No Uncovery 1.993 x 105

+ 60 Sec.

CASE 1 Level 2 78.3 No Uncovery 1.937 x 105

+ 60 Sec.

0 CASE 2 Level 2 78.3 390 1.755 x 105

+ 60 Sec.

a

• TOP OF ACTIVE FUEL THIGH PRESSURE INITIATION SETPOINT PLUS 60 SECONOS

4 i

t TABLE 2 RESULTS FOR BWR/6 STUCK-0 PEN RELIEF VALVE j

N0 HIGH PRESSURE SYSTENS AVAILABLE I

LIQUID INVENTORY IN i

DEPRESSURIZATION CORE CORE AND LOWER PLENUN i

DEPRESSURIZATION INITIATION UNCOVERED AT LOW PRESSURE ECCS CASE LEVEL TINE (SEC)

TINE (SEC)

INJECTION (LBS)

FULL AOS TAF*

642.6 No Uncovery 1.836 x 10s CASE 1 TAF 642.6 15 1.787 x 105 CASE 1 34' 391.8 No Uncovery 1.889 x los l.L CASE 1 Lcvel 2 t 77.7 No Uncovery 1.961 x 105 l

?

+ 60 Sec.

1 i

l

• TOP OF ACTIVE FUEL THIGH PRESSURE INITIATION SETPOINT PLUS 60 SECONOS

i i

TABLE 3 RESULTS FOR BWR/3 OUTSIDE STEAMLINE BREAK N0 HIGH PRESSURE SYSTEMS AVAILABLE LIQUID INVENTORY IN DEPRESSURIZATION CORE CORE AND LOWER PLENUM DEPRESSURIZATION INITIATION UNCOVERED AT LOW PRESSURE ECCS CASE LEVEL TIME (SEC)

TIME (SEC)

INJECTION (LBS) l FULL ADS TAF*

1527.8 155 2.027 x 105 1

CASE 1 TAF 1527.8 170 1.975 x 105 CASE 1 34' 701.6 51 2.291 x 105 i

FULL ADS Level 1 t 364.4 No Uncovery 2.446 x 105 j:

+ 60 Sec.

CASE 1 Level 1 364.4 10 2.394 x 105

+ 60 Sec.

l e

a 5

" TOP OF ACTIVE FUEL THIGH PRESSURE INITIATION SETPOINT PLUS 60 SECONDS

i TABLE 4 RESULTS FOR BWR/3 OUTSIDE STEAMLINE BREAK ON APPENDIX K ASSUMPTIONS WITH NO HIGH PRESSURE SYSTEMS LIQUID INVENTORY IN DEPRESSURIZATION CORE CORE AND LOWER PLENUM DEPRESSURIZATION INITIATION UNCOVERED AT LOW PRESSURE ECCS CASE LEVEL TIME (SEC)

TIME (SEC)

INJECTION (LBS)

FULL ADS TAF*

759.4 264 1.960 x 105 j

CASE 1 TAF 759.4 277 1.913 x 105 l

FULL ADS Level 1 t 145.6 175 2.21'O x 105

+ 60 Sec.

e KI CASE 1 Level 1 145.6 191 2.165 x 105

+ 60 Sec.

i i

• TOP OF ACTIVE FUEL THIGH PRESSURE INITIATION SETPOINT PLUS 60 SECONOS

....; _ c,.:

APPENDIX A NUREG-0737 ITEM II.E.3.45 This report applies to the following plants, whose Owners participated in the report's development.

Boston Edison Pilgrim 1 Carolina Power & Light Brunswick 1 & 2 Commonwealth Edison LaSalle 1 & 2 Dresden 2 & 3, Quad Cities 1,2 Georgia Power Hatch I & 2 Iowa Electric Light & Power Duane Arnold l

Jersey Central Power & Light Oyster Creek 1 Niagara Mohawk Power Nine Mile Point 1 & 2 Nebraska Public Power District Cooper Northeast Utilities Millstone 1 Northern States Power Monticello Philadelphia Electric Peach Bottom 2 & 3; Limerick 1 & 2 Power Authority of the State of New York Fitzpatrick Tennessee Valley Authority Browns Ferry 1-3; Hartsville 1-4, Phipps Band I & 2 l

l Vermont Tankee Nuclear Power Vermont Tankee Detroit Edison Enrico Fermi 2 Long Island Lighting Shoreham Mississippi Power & Light Grand Gulf I & 2 Pennsylvania Power & Light Susquehanna 1 & 2 l

Usshington Public Power Supply System Hanford 2 Cleveland Electric Illuminating Perry 1 & 2 Houston Lighting & Power Allens Creek Illinois Power Clinton Station 1 & 2 Public Service of Oklahoma Black Fox 1 & 2 - _ _ _.

SNPS-1 FSAR II.K.3.46 Response to List of Concerns from ACRS Consultant (Mr.

C. Michelson)

NRC Position A series of questions have been posed by Mr. C. Michelson regarding various aspects of PWR and BWR reactor operation.

Those pertaining to BWRes address the rollowing topics:

Isolation of Small Breaks 1.

Question 2 2.

Question 6 Recirculation Mode of Operation of High Pressure Coolant Injection (HPCI) pump 3.

Question 7 Simultaneous Operation of HPCI and Residual Heat Removal (RHR) pumps 4.

Question 9 Mm tmum Flow Protection for HPCI Pumps 5.

Question 11 -

Impact of Continued Running of Recirculation Pumps During a small Loss of Coolant Accident (LOCA) 6.

Question 12 -

Impact of Pump Seal Damage and Leaxage During a Small Break LOCA with Loss of Offsite Power Effect or Noncondensable Gas Accumulation 7.

Question 14 8.

Question 15 -

Impact and Consequences of Activating the Containment Spray System Following a

Small Break LOCA 9.

Question 16 -

Isolation of a Pipe Break Following LOCA BWR Owners

• Group Discussion General E.lectric has reviewed these questions and prepared responses on behalf of the BWR Owners' Group.

These responses are contained in a

letter, R. H.

Buchholz to D. F.

Ross,

" Response to Questions Posed by Mr. C.

Michelson,"

FeDruary 21, 1980, included as Attachment 1.

BWR Owners

• Group Implementation Criteria The questions and associated responses have not identitled a need for any plant modifications.

This section is, therefore, not applicable.

LILCO Position LILCO endorses the responses of General Electric as contained in.

Note in Question 12 of Attachment 1,

for Shoreham external cooling is required for the RHR pump seals for the shutdown cooling mode only.

1 II.K.3.46-1

ATTACIDfENT 1 GENERAL h ELECTRIC auctura POwaa SYSTsMS DIVISION GENERAL ELECTRIC COMPANY,175 CURTNER AVE., SAN JOSE, CALIFORNIA 96125 MC 682, (408) 925-5722 RHB-008-80 MFN-041-80 February 21, 1980 l

U. S. Nuclear Regulatory Commission Division of Project Management Office of Nuclear Reactor Regulation Washington, D. C.

20555 Attention:

D. F. Ross Gentlemen:

SUBJECT:

RESPONSE TO QUESTIONS POSED BY MR. C. MICHELSON

Reference:

Letter, D. F. Ross to T. D. Keenan, Information Required to Address Michelson's Concerns for Boiling Water Reactors, 10/17/79 The reference letter requested that the BWR Owners Group review and respond to questions posed by Mr. C. Michelson which were included as Enclosures A and B of the reference.

General Electric has reviewed these questions and prepared responses on behalf of the BWR Owners Group.

Sixty (60) copies of these responses are enclosed for use by your staff.

Sincerely, (Af b R. H. Buchholz, Manager BWR Systems Licensing Safety and Licensing Operation RHB: cas/119-M Enclosure cc:

BWR Owners Group aT W $ o$

4

RESPONSE TO QUESTIONS POSED BY MR. C. MICHELSON QUESTION 1 Pressurizer level is an incorrect measure of primary coolant inventory.

RESPONSE

BWRs do not have pressurizers.

BWRs measure primary coolant inventory directly using differential pressure sensors attached to the reactor vessel.

Thus, this concern does not apply to BWRs.

QUESTION 2 The isolation of small breaks (e.g., letdown line; PORV) not addressed or analyzed.

RESPONSE

Automatic isolation only eccurs for breaks outside the containment.

Such breaks are addressed in Section 3.1.1.1.2 of NEDO-24708.

It was shown that if the high pressure systems are available no operator actions are required.

If it is assumed that all high pressure systems fail, the operator must manually depressurize to allow the low pressure systems to inject and maintain vessel water level.

Analyses submitted for demonstration of adequate core cooling

• show that the operator has sufficient information and time to perform these manual actions.

The necessary manual actions have been included in the operator guidelines for small break accidents.

QUESTION 3 Pressure boundary damage due to loadings from a) bubble collapse in subcooled liquid and 2) injection of ECC water in steam-filled pipes.

RESPONSE

The BWR has no geometry equivalent to that identified in Michelson's report on B&W reactors relative to bubble collapse (steam bubbling upward through the pressurizer surge line and pressurizer).

Thus the first concern is not applicable to BWRs.

ECC injection in the BWR at high pressure is either directly into the reactor vessel (BWP/3-6 HPCS, HPCI on some BWR/4) or into the feedwater lines (FWCI, HPCI on most BWR/3-4).

The feedwater lines are normally filled with relatively cold liquid (420*F or less).

ECCS injection in the BWR at low pressure is either directly into the reactor vessel (LPCS, BWR/5-6 LPCI) or into the recirculation pump discharge line (BWR/3,4 LPCI) near the automatically-closed recirculation pump discharge valve.

Thus the second concern is not applicable to BWRs.

" NEDO-24708 Section 3.5.2.1, which was submitted in prepublication form to D. F. Ross by letter from R. H. Buchholz on November 30, 1979.

KW:cas:gm/119-N 1

/-

/

/

QUESTION 4 In determining need for steam generators to remove decay heat, consider that break flow enthalpy is not core exit enthalpy.

RESPONSE

BWRs do not use steam generators to remove decay heat, so this concern does not apply to BWRs.

The GE modelling of break flow is discussed in NEDO-20566.

QUESTIOM 5 Are sources of auxiliary feedwater adequate in the event of a delay in cooldown subsequent to a small LOCA?

RESPONSE

BWRs do not need feedwater to remove heat from the reactor following a LOCA, whether the subsequent cooldown is delayed or net.

Therefore this concern is not applicable to BWRs.

8WRs have a clor,ed cooling system in which vessel water flows out the postulated break to the suppression pool.

The suppression pool is cooled and l

water is pumped back to the vessel with ECCS pumps.

QUESTION 6 Is the recirculation mode of operation of the HPCI pumps at high pressure an established design requirement?

RESPONSE

The high pressure injection systems utilized in the BWR's are the Reactor Core Isolation Cooling (RCIC), High Pressure Coolant Injection (HPCI) and High Pressure Core Spray (HPCS).

l t

BWR/1 and 2 units do not have special purpose high pressure safety injection systems, such as HPCI and RCIC.* Some BWR'.s 3 and all BWR's 4, 5, and 6 are provided with RCIC systems.

Some BWR's 3 and all BWR's 4 are provided with HPCI systems.

BWR's 5 and 6 are' provided with HPCS systems.

The RCIC and HPCI are steam turbine driven variable speed systems.

The HPCS is an electrically driven constant speed system.

The RCIC, HPCI and HPCS systems normally take suction from the condensate storage tank and have an alternate suction source from the suppression pool.

A recirculation mode of operation of these systems is established when the system suction is from the suppression pool. Following a LOCA when system suction is from the suppression pool, water injected into the reactor is discharged through the break and flows back to the suppression pool forming a i

closed recirculation loop.

Other recirculation modes include test modes (e.g., suction from and dische se to the condensate storage tank) and system operation on low flow bypass with discharge to the suppression pool.

All of these modes are established design requirements.

" One unit is installing a high pressure injection system -- it is not yet in service.

XW:cas: gam /119-N 2

QUESTION 7 Are the HPCI pumps and RHR pumps run simultaneously? Do they share common piping?/ suction?

If so, is the system properly designed to accommodate this mode of operation (i.e., are any NPSH requirements violated, etc...?)

RESPONSE

As noted in response to Question No. 6. BWR/1 and 2 units do not have special purpose HPCI or RCIC systems.

~

For BWR/3-6 the high pressure injection systems (RCIC/HPCI/HPCS) do not share any common suction piping with the RHR,' Low Pressure Coolant Injection (LPCI), or low pressure core spray systems, and they can operate simultaneously with these low pressure systems.

The RCIC/HPCI and RCIC/HPCS systems, on so.w BWR's, share a common suction line from the condensate storage tank.

Many of the BWR LPCI pumps (LPCI on most BWR's is a subsystem of the RHR) and low pressure core spray (CS) pumps share common suction piping.

The RHR shutdown cooling operating mode does not share any common suction piping with the RCIC, HPCI, HPCS, CS/LPCS systems.

It is an established design requirement to size the suction piping, including shared piping, such that adequate NPSH is available to RCIC, HPCI, HPCS, RHR/LPCI, and CS pumps for all simultaneous operating modes of these systems.

Pre-operational and/or startup tests are conducted that demonstrate that the requirement is met.

QUESTION 8 Mechanical effects of slug flow on steam generator tubes needs to be addressed (transitioning from solid natural circulation to reflux boiling and back to solid natural circulation may cause slug flow in the hot leg pipes.)

RESPONSE

BWRs do not have steam generators so this concern does not apply to BWRs.

BWR post-LOCA cooling modes are addressed in NED0-24708.

QUESTION 9 Is there minimum flow protection for the HPCI pumps during the recirculation mode of operation?

RESPONSE

As noted in response to Question No. 6, BWR/1 and 2 units do not have special purpose HPCS or RCIC systems.

For BWR/3-6, the RCIC, HPCI, HPCS, RHR, and CS/LPCS pumps all contain valves, oiping, and automatic logic that bypasses flow to the suppression pous as required to provide minimum flow protection for all design basis operating modes of the systems.

KW:cas: gam /119-N 3

C l

QUESTION 10 The effect of the accumulators dumping during small break LOCAs is not taken into account.

RESPONSE

BWRs do not use accumulators to mitigate LOCAs.

Therefore this concern does not apply to BWRs.

QUESTION,11 What is the impact of continued running of the RC pumps dur.ing a small LOCA?

RESPONSE

The impact of continued running of the recirculation pumps has been addressed in Sections 3.3.2.2, 3.3.2.3, and Section 3.5.2.1.5.1 of NEDO-24708.* The conclusions were that continued running of the l

recirculation pumps results in little change in the time available for operator actions and does not significantly change the overall system response.

QUESTION 12 During a small break LOCA in which offsite power is lost, the possibility and impact of pump seal damage and leakage has not been evaluated or analyzed.

RESPONSE

The RCIC, HPCI, HPCS, RHR, CS/LPCS pumps are provided with mechanical seals.

These seals are cooled by the pump primary process water.

No external cooling from auxiliary support systems, such as site service water or room air coolers, is required for pump seals. These types of seals have demonstrated (in nuclear and l

other applications) their capability to operate for extended periods l

of time at temperatures in excess of those expected following a LOCA.

Should seal failure occur it can be detected by room sump high level alarms.

The RCIC, HPCI, HPCS, LPCS and CS and RHR individual pumps are arranged, and motor operated valves provided, so that a pump with a failed seal can be shutdown and isolated without affecting the proper operation of the other redundant pumps / systems.

Considering the low probability of seal failure during a LOCA, the fact that a pump with a failed seal can be isolated without affecting other redundant equipment, and the substantial redundancy provided in the BWR emergency cooling systems, pump seal failure is not considered a significant concern.

" The latter section was transmitted in prepublication form to D. F. Ross by letter from R. H. Buchholz on November 30, 1979.

KW:cas: gun /119-N 4

i

/

./

QUESTION 13 During transitioning from solid natural circulation to reflux boiling and back again, the vessel level will be unknown to the operators, and emergency procedures and operator training may be inadequate.

This needs to be addressed and evaluated.

RESPONSE

There is no similar transition in the BWR case.

In addition, the BWR has water level measurement within the vessel and the indication of the water level is incorporated into the operator guidelines.

Consequently this concern does not apply to BWRs.

QUESTION 14 The effect of non-condensible gas accumulation in the steam generators and its possible disruption of decay heat removal by natural circulation needs to be addressed.

RESPONSE

The effect of non-condensible gas accumulation is addressed in Section 3.3.1.8.2 of NED0-24708.

For a BWR, vapor.is present in the core d ring both normal operation and natural circulation conditions.

Non-condensibles may change the composition of the vapor but would have an insignificant effect.on the natural or forced circulation itself, since the non-condensibles would rise with the steam to the top of the vessel after leaving the steam separators.

CONCERN 15 Delayed cooldown following a small break LOCA could raise the containment pressure and activate the containment spray system.

Impact and consequences need addressing.

RESPONSE

A.

Mark I and II Containments:

Except for a few early plants, most plants with Mark I and II l

containments do not have an automatically initiated drywell or wetwell spray.

Only one of the newer plants (not yet operating) has an automatic wetwell spray.

It is very unlikely that the operator would manually initiate drywell sprays even given that a LOCA has occurred.

Some l

non-essential equipment in the drywell (e.g., recirculation pumps) could be adversely affected by drywell spray.

511 essential equipment in the drywell has been qualified for the steam and temperature environment that would exist following a LOCA.

There is no equipment in the wetwell that is adversely affected by wetwell sprays.

KW:cas: gust /119-N 5

,/

B.

Mark III Containments:

There is no drywell spray in a Mark III containment.

There is an automatic spray system in the wetwell (containment).

All essential equipment has been qualified fer this condition.

00ESTION'16* This concern relates to the possibility that an operator l

may be inclined and perhaps even trained to isolate, where possible, l

a pipe break LOCA without realizing that it might be an unsafe action leading to high pressure, and short-term core bakeout.

For example, if a BWR should experience a LOCA from a pressure boundary failure somewhere between the pump suction and discharge valve for either reactor recirculation pump, it would be possible for the operator to close these valves following the reactor blowdown to i

low pressure and thereby isolate the break, stop the blowdown, and i

l repressurize the reactor coolant system.

Before such isolation should be permitted, it is first necessary to show by an appropriate analysis that the high pressure ECCS is adequate to reflood the uncovered core without assistance from the low pressure ECCS which can no longer deliver flow because of the repressurization.

Otherwise, such isolation action should be explicitly forbidden in the emergency operating instructions.

RESPONSE

If a BWR should experience a LOCA from a pressure boundary failure somewhere between the recirculation pump suction and discharge valves, it is possible for the operator to close these valves I

following the reactor blowdown to low pressure and thereby isolate l

the break.

In Reference 2, the NRC concluded based on information provided by GE that recirculation break isolation is not a problem.

In order for the reactor vessel to repressurize following isolation of a recirculation line break, the isolation would have to occur before initiation of ADS due to a high drywell pressure in concurrence with low water level 1 condition.

Isolation of a recirculation line break prior to obtaining a high drywell pressure signal might occur for very small breaks (area u 0.01 ft2) which may require several hundred seconds following the break to reach l

l the high drywell pressure set point.

In this case it has been l

shown in Reference 3 that the high pressure systems (RCIC, HPCI/HPCS, feedwater, and CRD) are sufficient to maintain the water level l

above the top of the core.

l

" Excerpt from Reference 1.

KW:cas: gen /119-N 6

1

i

/

If isolation of the recirculation break were to occur prior to reaching level I but after the high drywell pressure signal the vessel would pressurize to the SRV set point following isolation of the main steam lines and then oscillate as the SRVs cycle open and closed.

If no high pressure systems were available, the loss of mass out the SRVs would cause the level to continue dropping and result in automatic ADS actuation shortly after reaching level 1.

This would depressurize the vessel and allow the low pressure systems to begin injecting.

This capability was demonstrated in ana' lyses presented in Reference 3.

The small-break operator guidelines,

in NEDO-24708, in addition, explicitly provide for manual depressuri-zation in the event of low reactor water level with high pressure systems unable to maintain level for any reason.

In summary, in order to repressurize the vessel following recirculation break isolation, the isolation would have to occur prior to ADS blowdown. For these cases, high pressure systems would maintain inventory and it has been shown that no adverse consequences result from isolation of a break in the recirculation line.

1 l

l l

l KW:cas: gun /119-N 7

1

t

/

REFERENCES:

1.

Memo, C. Michelson to D. Okrent, "Possible Incorrect Opbrator Action Such as Pipe Break Isolation," June 4, 1979.

2.

Letter, D. G. Eisenhut to R. L. Gridley, " Potential for Break

, Isolation and Resulting GE-Recommended BWR/3 ECCS Modifications,"

June 14, 1978.

3.

" Additional Information Required for NRC Staff Generic Report on Boiling Water Reactors," NEDO-24708, August 1979.

l I

i l

l

~

l l

l KW:cas/119-N 8

v

-,a v-,,

-,n-,-,-----,--

---,,a--.,-:,a,-

--r

-